Compliance, Auditing & Governance (NIST RMF, EU AI Act)

When: Basic auditability Weeks 5--8; formal framework work after the core project is stable.

• Learn the purpose and high-level structure of NIST AI RMF and the EU AI Act. Applicability depends on jurisdiction, use case, provider/deployer role, and risk category; this is not legal advice.

• Understand SOC 2 as an organizational control/audit framework, not a library.

• Record security events: authenticated principal, agent identity, tool, resource, authorization decision, approval reference, timestamp, outcome, and correlation ID.

• Use append-only or tamper-evident audit design where justified; define retention, access, deletion, and privacy controls.

• Do not store every raw prompt/retrieved document forever. Balance auditability with data minimization, privacy, and retention.

• Add bias/fairness evaluation when relevant to the product's users and decisions.

Practice: build an audit trail for tool calls and approvals. Store hashes/references to sensitive payloads where possible; restrict access and document retention. Test that ordinary application APIs cannot modify audit records.

Do not learn yet: claim "immutable" because a database table is append-only, or attempt SOC 2 certification as an individual project.