The security post (order 24) of the Sandbox Series. Compliance requirements for regulated industries (finance, healthcare) using sandboxes — SOC 2, HIPAA, GDPR, ISO 27001, EU AI Act — audit process, data sovereignty, and cross-border restrictions.
Governance carries more weight on these exams than most engineers expect — CCAR-P is 14% governance plus 14% stakeholder work (28% non-technical), CCAO-F is 15%, AB-100's deploy-and-govern block is 40–45%, AIF-C01 is 14% responsible AI plus 14% security/compliance/governance. But across all fifteen official exam guides in this series, not one names the EU AI Act, the NIST AI RMF, or ISO/IEC 42001; the only regulations any of them names are CCAR-P's GDPR, HIPAA, and FedRAMP. So the use of this post isn't memorizing frameworks for an exam — it's using the three frameworks as a skeleton to file six certifications' scattered governance objectives. The three split cleanly: the EU AI Act is law (fully applicable 2026-08-02, high-risk duties pushed to 2027-12-02 by the AI Omnibus), the NIST AI RMF is voluntary (GOVERN/MAP/MEASURE/MANAGE, and 1.0 is currently being revised), and ISO/IEC 42001 is a certifiable management system standard whose clauses are paid, so this post covers only what is on ISO's public page.
Reading the whole specification turns up three counter-intuitive things: of the seven mandatory items only three sit on the aircraft and the rest on the ground control station; an unencrypted link still passes, as long as the manual or the box states the reason or the risk — the rule asks for disclosure, not encryption; and the five items that actually test resilience (spoofing, jamming, link loss, known firmware vulnerabilities, app certification) are all in Chapter 8, which is optional.
Anthropic's 35-page startup handbook released 2026-05-14 reorganizes Idea/MVP/Launch/Scale around agentic AI. The most valuable takeaways are 'the easier it is to build, the more important validation becomes' and treating CLAUDE.md as the first MVP artifact. The part to discount: the Launch chapter puts compliance workstreams on Cowork -- but Anthropic's own docs say Cowork doesn't write audit logs.