Compliance: the regulatory landscape
This course maps six compliance regimes a Rails engineer hears about: GDPR, LGPD, HIPAA, the EU AI Act, ISO 27001 with ISO 42001, and SOC 2 Type II. For each one it explains what kind of instrument it is, what triggers it and which role it assigns, such as controller, processor, business associate, provider or deployer. It separates laws enforced by regulators from certifiable standards and attestation reports. It closes by showing where the regimes demand the same evidence in a Rails codebase.
What you'll learn
- ✓What kind of instrument each regime is: law, sector statute, risk-based regulation, certifiable standard or attestation
- ✓How GDPR and LGPD are triggered and how controller and processor roles differ
- ✓When HIPAA applies and what a business associate agreement does
- ✓EU AI Act risk tiers, provider and deployer roles, and its staggered timeline
- ✓What an ISO 27001 certificate and a SOC 2 Type II report each claim
- ✓How shared controls such as audit logs and deletion pathways map to several regimes
The missing half of AI governance
The senior course "AI management system: ISO 42001" closed with a confession. Seven lessons built an inventory, a policy, an impact assessment, an evidence trail, a release gate and an audit cycle. Together they make a machine for reaching a defensible decision about an AI system, again and again,…
Read the full lesson free →Curriculum
7 lessonsThe missing half of AI governance
Separates process from law and sorts six regimes by the kind of instrument each one is.
GDPR and LGPD: what actually triggers them
GDPR and LGPD apply based on whose data you process, and they split duties between controllers and processors.
HIPAA: covered entities and business associates
HIPAA binds covered entities and business associates handling protected health information, linked by a business associate agreement.
The EU AI Act: risk tiers and roles
The EU AI Act sorts systems into risk tiers, assigns duties to providers and deployers, and phases in obligations.
ISO 27001 and ISO 42001 as certifiable standards
ISO 27001 and ISO 42001 are certifiable management standards that certify an audited, repeatable process, checked on a recurring cycle.
SOC 2 Type II: an auditor's opinion, not a certificate
SOC 2 Type II is an auditor's signed report on controls, scoped by the Trust Services Criteria over a period.
One evidence trail, six regimes
Shows where the six regimes demand the same controls and how one shared control, such as an audit log, serves several of them.