Section — Compliance & Risk Management

Compliance is the Floor. Risk Management is the Discipline.

Certifications are necessary, never sufficient. The frontier APIs and platform context engines have closed the certification gap — but every project still requires its own legal, architectural, and contractual review before regulated data touches the system.

1. The acronyms — what they stand for, what they cover
GDPR
General Data Protection Regulation

EU regulation (2018) governing the processing of personal data of EU residents. Establishes lawful basis, data subject rights, breach notification, and cross-border transfer rules. Fines up to 4% of global annual turnover.

Triggered when You process personal data of any EU resident, regardless of where your company is based. Requires a Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) for transfers outside the EU.
HIPAA
Health Insurance Portability and Accountability Act

US law (1996) protecting Protected Health Information (PHI). The Security Rule mandates technical, administrative, and physical safeguards. Enforced by HHS Office for Civil Rights.

Triggered when Any system handles PHI in the US. Cloud and AI vendors are Business Associates and require an executed Business Associate Agreement (BAA) before any PHI touches the service. No BAA = direct violation.
SOC 2
System and Organization Controls 2

AICPA framework auditing controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy. Type I = controls exist on a date. Type II = controls operated effectively over 3–12 months.

Triggered when Enterprise B2B procurement — effectively required for selling to large customers. Always demand Type II; Type I alone is insufficient for serious regulated buyers.
ISO 27001 / 27701 / 42001
International Organization for Standardization

27001: Information Security Management Systems. 27701: Privacy Information Management (extends 27001 for GDPR alignment). 42001: AI Management Systems — the world’s first AI-specific standard (2023).

Triggered when International procurement, especially in Europe and Asia. ISO 42001 is increasingly demanded for AI-specific deployments and is the strongest signal of mature AI governance.
FedRAMP
Federal Risk and Authorization Management Program

US federal authorization for cloud services. Three impact levels: Low, Moderate, High. High covers data whose loss could cause severe damage to national security, life, or finances. Required for US federal agency deployments.

Triggered when Deploying for any US federal agency. FedRAMP High is the bar for sensitive workloads. Anthropic, Google, and AWS now hold FedRAMP authorization for their AI services.
BAA & DPA
Business Associate Agreement & Data Processing Addendum

The two contracts that turn certification eligibility into actual compliance. BAA: the HIPAA contract between you and your vendor. DPA: the GDPR contract defining controller / processor responsibilities. Both are non-negotiable prerequisites, not optional add-ons.

The hard rule Eligibility without an executed BAA / DPA is not compliance. HHS has fined organizations $1.55M+ for missing BAAs even when no breach occurred.
2. Coverage across frontier APIs and platform context engines — April 2026
Provider / Tier SOC 2 Type II HIPAA (BAA) GDPR (DPA) ISO 27001 FedRAMP
Anthropic Claude API (commercial / enterprise tier) ✓all systems & API ✓BAA on enterprise ✓DPA + SCCs ✓ ✓High — via AWS / GovCloud
OpenAI API (API platform / enterprise) ✓API + business products ✓BAA via Healthcare / API ✓DPA + data residency ✓27001, 27017, 27018, 27701 ●via Azure OpenAI
Google Gemini / Vertex AI ✓ ✓Google Cloud BAA + project flag ✓EU residency available ✓+ ISO 42001 for AI ✓High
AWS Bedrock / Bedrock AgentCore ✓SOC 1, 2, 3 Type II ✓HIPAA eligible + BAA ✓ ✓27001/17/18/701, CSA STAR L2 ✓High in GovCloud
Azure AI Foundry / Azure OpenAI ✓ ✓Microsoft Online Services BAA ✓100+ Azure compliance offerings ✓ ✓High
Google Vertex AI Agents ✓ ✓ ✓ ✓ ✓
Salesforce Agentforce, IBM watsonx, ServiceNow, UiPath, Kore.ai (enterprise tiers) ✓ ✓BAA on enterprise ✓ ✓ ●varies by vendor
n8n (self-hosted open source) ●inherits your infra ●customer responsibility ●customer responsibility ●inherits your infra —
Free / Pro / Plus tiers of any provider (ChatGPT Pro, Claude Pro, Gemini Advanced) — — ●limited DPA — —
Certified / contractually available on enterprise tier Conditional — depends on configuration, region, or vendor variant Not available on this tier
3. The four rules that turn certification into compliance
RULE 01

Enterprise tier only

Certifications apply to commercial / enterprise / business tiers. Consumer plans (Free, Pro, Plus, Advanced) are out of scope — never use them with regulated data, even for prototyping.

RULE 02

BAA / DPA executed before data flows

An eligible service is not a compliant service until the contract is signed. HHS has fined covered entities for missing BAAs even when no breach occurred. The “no-view” defense does not work.

RULE 03

Configuration is on the customer

VPC endpoints, regional residency, encryption keys, retention policy, audit logging, prompt logging settings — all customer-side. The platform gives you the levers; you must pull them, document them, and prove them in audit.

RULE 04

Your context engine inherits nothing

The certification covers the platform, not your application on top of it. Your planner, your agents, your retrieval pipeline, your tracer, your memory store — your responsibility, audited separately. The compliance perimeter has moved up the stack.

The discipline

Every project starts from scratch with the legal department. Data flow, threat model, contractual chain, regulatory surface, configuration — all project-specific, all reviewed before deployment. The certifications above are the floor that lets the conversation start. They are not the conversation.