Tagged compliance
4 pieces
- · 11 min read
Your AI Vendor's Terms May Ban Your Users: Read the Population Restrictions Before You Pick a Model
Major generative AI providers' terms bar applications that are directed at, or likely to be used by, people under eighteen. The moment a product defines a Student or a Child role, an entire class of model provider is ruled out. Because this is almost always discovered after the architecture is drawn, it arrives as a rebuild rather than as a constraint. Here is how to read provider terms for user-population restrictions, what to do with a mixed user base, and why the clause has to be re-verified at build time.
- · 8 min read
The Number Someone Signs: Rebuild It by Rule, Do Not Read It Off the Document
When a person certifies a figure your system produced, extraction accuracy is the wrong metric. The document your pipeline reads can be perfectly extracted and still contain a total that must not be claimed, because a rule outside the document excludes part of it. The deliverable is a figure rebuilt by classification from the line items, with each charge categorised, and scored against what was actually filed rather than against what was extracted.
- · 10 min read
Where Your Inference Actually Runs
Data residency for model inference is frequently not selectable in the way teams assume. Cross-region routing can place inference outside an intended boundary, and some global endpoints explicitly exclude residency guarantees. This has to be established in writing before an architecture depends on it, and the design has to survive the answer changing.
- · 9 min read
The Most Important Screen Is A Database Decision
In a regulated product, which system holds the official copy of each piece of data sets the compliance posture, the monthly cost, and whether later integrations are additions or rebuilds. It is not a screen and it is the first decision. Decide it per datum, not once for the whole product.