Governance, risk & sovereignty

Status: complete (published 2026-08-19). Scope finalized at Batch B kickoff with maintainer POV; see findings.md and sources.md.

Scope inventory (v0)

• Regulatory map: EU AI Act obligations and timeline, NIST AI RMF, DORA, NIS2, sector regimes per vertical (HIPAA, FedRAMP, NERC CIP, RBI, DPDPA), cross-border transfer mechanisms
• Operating governance: AI council and use-case intake, risk tiering, impact assessments (DPIA/AIA), model risk management, third-party and procurement risk for agent vendors
• Records and accountability: retention and eDiscovery for agent memory and outputs, evidence packs for regulators, liability and the Sponsor pattern, insurance
• Sovereignty: deployment spectrum (managed API to air-gapped), classification-based routing, localization requirements

Challenged-default candidates

AI governance platforms vs extending GRC tooling; sovereign cloud offerings vs region pinning with contractual controls. Each track proposes its final list at kickoff.

Files

findings.md and sources.md carry this track's research. The scoping brief and the vendor map were archived on 2026-08-23 (see archive/, decision D038).