Compliance means conforming an enterprise GenAI application to applicable laws, regulations, standards, policies, and contractual requirements. It becomes essential when models process personal or otherwise sensitive data. section 11.1
A production compliance program combines governance with technical and operational controls:
- Identify the requirements that apply, including consent, personal-data handling, breach response, record-keeping, and vendor responsibilities. section 11.1
- Protect data with encryption at rest and in transit, secure protocols such as TLS, strict access control, role-based access control, and least privilege. section 11.4.8
- Audit applications and infrastructure regularly through security assessments, vulnerability scanning, and compliance checks. section 11.4.8
- Monitor unusual usage and unauthorized access attempts so teams can investigate incidents and respond quickly to breaches or misuse. section 11.1 section 11.4.8
Production GenAI deployment
An enterprise deploying an LLM for sensitive customer data maps its obligations to consent and privacy controls, encrypts stored and transmitted data, restricts production access with RBAC and least privilege, audits the environment, and monitors anomalous activity. It can also use compliance capabilities provided by its cloud platform, while retaining responsibility for configuration, records, training, and incident response. section 11.1 section 11.4.8
