AI governance, minus the marketing
Reference material on what the law requires, what the frameworks ask for, and what works in practice. Written for the person who will have to take it to legal, to the committee or to the auditor, not to generate a lead. Nothing here asks for a signup.
Research: more than one in four AI tools we cataloged no longer exists →
What does the NIST AI RMF ask for, and where do you start?
6 minThe four functions in plain language, and why the AI inventory comes first.
Does SOC 2 cover AI tools?
7 minSOC 2 is an attestation, not a certification, and what you are asked when employees use AI.
Can employees use ChatGPT and other AI tools with patient data under HIPAA?
9 minBAAs, de-identification, minimum necessary, and why you cannot prove what you never saw.
Is it safe to use ChatGPT at work?
6 minIt depends on the plan and what you paste: what changes between Free, Plus, Business and Enterprise.
What is AI governance?
8 minThe definition, the seven pillars, who owns what and where to start.
What are the risks of AI in the workplace?
9 minSeven risks, one fact, one control and one test for each, plus a 30-day plan.
How do you choose an AI governance platform?
12 minTen criteria, a scoring table and the red flags for comparing vendors.
How do you find out which AI tools your employees use?
9 minFive data sources, their blind spots and a seven-day plan.
What is Shadow AI?
10 minThe definition, why banning fails, and what to do instead.
Does Brazil's LGPD ban AI at work?
11 minArticle by article: legal basis, records of processing, international transfers, and what becomes an audit finding.
What should an AI usage policy contain?
9 minTen sections, the suggested wording for each, and why every clause is there.
How do you build an AI inventory (AI-BOM)?
7 minThe document every framework assumes and almost no company has. Fields, sources and the order to build it.
What does ISO/IEC 42001 require in practice?
7 minStructure, Annex A controls, what carries over from ISO 27001, and the road to certification.
Does the EU AI Act apply to companies outside Europe?
7 minWhy it reaches companies that do not sell to Europe, the four risk tiers, and the calendar.
Missing a topic?
These guides are reviewed every six months and the list grows with the questions we get. If there is an AI governance topic that should be here, write to contato@tangerinai.com.