Topic starter
12/06/2026 12:38 am
TL;DR: The EU AI Act and the US Executive Order on AI both push organisations toward AI TRiSM, with disclosure, documentation, risk assessment, and stakeholder accountability becoming core compliance duties, according to Lasso Security. The practical shift is that AI governance now has to join legal, procurement, privacy, and security into one operating model rather than a series of disconnected reviews.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “Achieving Compliance with AI TRiSM: the EU AI Act and US Executive Order on AI”.
Key questions
Q: How should organisations govern GenAI before broad rollout?
A: They should define the business purpose, assign an accountable owner, and connect the program to explicit data, access, and logging controls before scale.
Q: Why do AI inventories matter for security and compliance teams?
A: AI inventories matter because you cannot control what you cannot see.
Q: What breaks when AI service logs are not enabled by default?
A: Detection becomes guesswork.
Practitioner guidance
- Map every AI deployment to a named owner Create an authoritative inventory that records the model, the business owner, the data it touches, and the approval path for use.
- Classify AI systems by regulatory risk Separate prohibited, high-risk, and limited-risk use cases before deployment decisions are finalised.
- Bind documentation to operational evidence Store training-data summaries, model documentation, and user interaction logs as governed records with retention and review ownership.
Bottom line: The article shows that AI TRiSM is becoming a governance requirement for regulated AI use, not a discretionary best practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 10:02 am
AI TRiSM is becoming the operating model for regulated AI, not a bolt-on control set. The article shows that the EU AI Act and the US Executive Order on AI both push disclosure, documentation, logging, and accountability into the core of deployment governance. That is a field-level shift because AI risk can no longer be managed after model selection or after a pilot goes live. Practitioners should treat AI TRiSM as the control fabric that connects legal, privacy, procurement, and security decisions.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: Should AI teams prioritise AI TRiSM before expanding GenAI use?
A: Yes, when the organisation operates in regulated or sensitive environments. AI TRiSM is the control structure that makes transparency, safety, and accountability testable, so expansion without it creates governance debt that becomes expensive to unwind later.
👉 Read our full editorial: AI TRiSM compliance under the EU AI Act and US AI order
This post was modified 1 day ago by NHI Mgmt Group