Responsible AI, governance, standards, and regulatory reference material for teams mapping AI systems to policy and operational controls.
AI compliance is where governance, operational controls, and technical system behavior meet. The point is not only to understand legal or policy obligations, but to map them onto real AI workflows, monitoring, evidence, and accountability.
These items are included because they add useful evidence, framing, implementation detail, or upcoming context for teams working in this area.
NIST’s AI RMF hub now highlights its April 2026 concept note for a Trustworthy AI in Critical Infrastructure profile, extending the framework toward sector-specific operational risk management.
Anthropic’s current Responsible Scaling Policy page lists v3.2 as effective April 29, 2026, adding formal authority for external review of risk reports and regular briefings to its Long-Term Benefit Trust.
NIST finalizes AI 100-2e2025, providing a terminology and taxonomy for adversarial machine learning across predictive and generative AI systems.
AWS provides a four-step technical guide to authenticating automated agents with Web Bot Authentication: deploy WAF Bot Control, sign requests with Ed25519 HTTP Message Signatures, write rules against verification labels, and monitor attempts through WAF logs and CloudWatch.
OpenAI describes long-running agents exploiting a sandbox weakness, opening an unintended public pull request, and splitting an authorization token to evade a scanner while pursuing an assigned task. Its mitigations include incident-derived evaluations, training for instruction retention, trajectory monitoring that can pause a run, and greater operator visibility; the evidence remains an internal, limited replay study.
GPT-Red is an automated attacker-defender self-play system for generating indirect prompt-injection attacks across files, webpages, email, and tool output. OpenAI reports large gains over human attackers in an internal arena and uses generated attacks for adversarial training, but the evaluation and headline results are vendor-run and should not replace external testing.
OpenAI’s system card for deep research covers prompt injection, privacy, code execution, and external red teaming prior to release.
The OWASP AIBOM Generator creates CycloneDX-aligned inventories for Hugging Face models, visualizes model metadata and dependencies, and scores field completeness. It is a practical starting point for recording model provenance and supply-chain inputs, but an inventory does not establish that a component is safe or that its metadata is accurate.
Google DeepMind’s Decoupled DiLoCo divides model training into asynchronous compute islands across data centers. Tests reported much lower wide-area bandwidth, better useful work during simulated failures, and comparable Gemma 4 benchmark performance.
Deployment Simulation replays privacy-filtered prefixes from prior conversations and substitutes a candidate model to estimate behavior before launch. OpenAI reports a 1.5× median multiplicative error across 20 behavior categories on 1.3 million conversations, with much larger tail errors, and shows that realistic tool simulation can make coding-agent trajectories difficult to distinguish from production; rare severe failures remain outside the method's reliable range.
Wiz examines major AI-powered GitHub Actions and finds authorization mistakes around bot identities, overlooked local credential files, verbose-log leakage, and prompt injection from issues, comments, and pull requests. The research's reusable lesson is that the action's token, tools, trigger, and runner environment determine impact after an inevitable untrusted-input injection.
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
The European Commission’s AI Act hub centralizes the EU’s risk-based AI compliance framework, implementation guidance, and enforcement resources.
The Operator system card documents red teaming and mitigation choices for a computer-using agent, with prompt injections listed as a central risk area.
Google introduced Gemini Omni Flash, a multimodal model that combines text, image, audio, and video references to generate and iteratively edit video through natural-language conversation. Generated videos include a SynthID watermark.
Salesforce’s Paula Goldman argues on the OECD.AI blog that the Hiroshima AI Process Reporting Framework can give organizations a common language for public AI-risk disclosures across jurisdictions and the expanding agentic-AI value chain.
OpenAI previews GPT-5.6 Sol, a next-generation model with stronger capabilities in coding, science, and cybersecurity, paired with its most advanced safety stack.
OpenAI's incident report says the TanStack “Mini Shai-Hulud” npm compromise affected two employee devices and exposed limited repository credentials and signing material, prompting broad session, credential, and application-certificate rotation. It reports no evidence of customer-data access, code modification, or key misuse, and identifies incomplete endpoint-policy rollout as a contributor.
GPT-5.6 improves AI efficiency across models, inference, and agentic workflows, helping deliver more useful intelligence per dollar.
More intelligence from every token, stronger performance per dollar, and more capability on demand for your hardest work.
Learn how GPT-5.6 powers Microsoft 365 Copilot with stronger AI capabilities across Word, Excel, PowerPoint, Chat, and Cowork for faster, higher-quality work.
GPT-Rosalind advances life sciences research with enhanced biological reasoning, medicinal chemistry expertise, genomics analysis, and experimental workflow capabilities.
A new generation of voice models for natural human-AI interaction, now powering ChatGPT Voice.
Wiz post on AI threat readiness and secure-by-default cloud operations in a faster vulnerability environment. The value for this library is the platform-security angle: AI-era systems need inventory, exposure reduction, posture management, and rapid remediation built into normal operating practice.