CONSULTING
(310) 855-4619

Rondthaler Labs, the R&D practice behind IT CloudLink LLC

AI governance for a regulated practice

The six-layer picture of AI governance was drawn for enterprises that train their own models and sell into the EU. A small clinic or law firm does neither. The layers still hold, with four corrections: a named owner, a feedback loop, your own regulator's rulebook, and deployment work in place of model-building.

Sources and legal status last checked October 6, 2026.

Six layers, one spine, one loop

Tap a layer to open it.

1 AI INVENTORY what is in use, by whom 2 DATA FOUNDATION what it answers from 3 DATA SECURITY & ACCESS who can see what 4 MODEL ASSURANCE does it do your work 5 HUMAN OVERSIGHT who reads the output 6 COMPLIANCE & AUDIT your rules, with proof MANDATE: owner · policy · limits findings return to the inventory

Each layer depends on the one above it: you cannot secure data you have not traced, or test a system you have not listed. The spine is who decides. The loop is what keeps the stack current.

1AI inventory

What is in use, by whom, on which data.

  • Shadow AI discoveryFind what staff already use: personal chatbot accounts, browser extensions, AI features switched on inside software you license.Evidence: a dated staff survey and a review of DNS or proxy logs.
  • Use-case registerOne row per use, not per tool. The same assistant drafting a newsletter and summarizing a chart is two rows.Evidence: the register itself.
  • Risk tieringSort rows by what a wrong answer would cost. An internal memo and a patient message do not share a tier.Evidence: a tier and a one-line reason on every row.
  • Named ownerOne person answers for each use.Evidence: a name, not a department, on every row.
  • Model and vendor registryModel name, version, license, where the weights came from, file hash. For hosted tools, the contract terms on retention and training.Evidence: registry entries that match what is running.

Closest NIST AI RMF function: Map.[1] Background: how a business drifts into consumer AI tools.

2Data foundation

If the system answers from your documents, the document set is its knowledge. Its quality is yours to manage.

  • Source trackingKnow which repositories feed each knowledge base.Evidence: a source list per knowledge base.
  • LineageEvery answer points to the document and passage it drew on.Evidence: citations in the output that open the source.
  • Quality validationBefore indexing, remove superseded drafts, duplicates, and scans whose text did not survive OCR.Evidence: an ingestion report listing what was excluded.
  • Freshness monitoringRe-index on a schedule. Flag documents past their review date.Evidence: last-indexed timestamps.
  • Representativeness checkWhere a system informs decisions about people, check that the data covers the people it will be used on. Scale the effort to the tier.Evidence: a note in the file of each top-tier use.

Closest NIST AI RMF functions: Map and Measure.[1]

3Data security and access

The assistant may see only what the person asking may see.

  • EncryptionAt rest and in transit, including the vector index and the backups.Evidence: storage and TLS configuration.
  • Minimization and de-identificationSend the model only what the task needs. "Anonymized" has a legal test: HIPAA recognizes two de-identification methods, Safe Harbor and Expert Determination.[13]Evidence: a data-flow diagram per use.
  • Permission-aware retrievalThe retrieval index enforces the same permissions as the file system. If a paralegal cannot open a folder, the assistant cannot quote from it.Evidence: access tests run as different roles.
  • Least privilege for toolsAn assistant that can send mail or edit records gets the narrowest set of actions. OWASP lists the failure as excessive agency.[5]Evidence: the permitted-action list per assistant.
  • Key and log managementPrompts and outputs are records and may hold patient or privileged material. Decide who can read them and for how long they are kept.Evidence: retention setting and log access list.

Closest NIST AI RMF function: Manage.[1] Threat catalogs: OWASP[5] and MITRE ATLAS.[6] Related: Security & Trust.

4Model assurance

You will likely never train a model. You still have to know which one you run and whether it does your work.

  • Model recordKeep the publisher's model card[7] and add your own facts: version, quantization, license, hash, date deployed.Evidence: one record per deployed model.
  • Task evaluationPublic leaderboards do not measure your work. Build a test set of a few dozen questions from your own documents with known answers.Evidence: scored results before go-live and after each change.
  • Fairness testingDepth follows the tier. It matters where output informs a decision about a person: hiring, coverage, credit.Evidence: test results in the file of each top-tier use.
  • Red-teamingPlant an instruction inside a document and see whether the assistant obeys it. Ask for files you should not get.[5]Evidence: a dated log of attempts and outcomes.
  • Change controlWeights on your own disk change only when you replace them. A hosted model can change on the vendor's schedule. Either way, pin the version and re-run the test set when the model, the prompt, or the document set changes.Evidence: a change log tied to test results.

Closest NIST AI RMF function: Measure.[1]

5Human oversight

A reviewer who approves everything is a signature, not oversight. NIST lists over-reliance on output among the risks of generative AI.[2]

  • Decision reviewState which outputs a qualified person must read before they leave the building. Some rules turn on it: California exempts AI-generated patient messages from its disclaimer requirement when a licensed provider has read and reviewed them.[15]Evidence: the review rule per use, and reviewer sign-off.
  • Escalation pathsStaff know what to do, and whom to tell, when an output looks wrong.Evidence: the written path, and reports that used it.
  • Stop authorityA named person can switch a use off without calling a meeting.Evidence: the name, a tested off switch, and a dated note of the reason each time it is used.
  • Output validationSample outputs on a schedule and check them against their sources. Record the error rate.Evidence: sampling log with counts.
  • Staff trainingEveryone who uses the system knows how it fails: confident wrong answers, stale sources, instructions hidden in documents.Evidence: attendance record and the material taught.

Closest NIST AI RMF functions: Manage and Govern.[1]

6Compliance and audit

Map the stack to the rules that bind you, then keep proof.

  • Regulatory mappingList the regimes your attorney confirms apply, and attach each to a control. For a California practice the list usually starts with HIPAA,[12] professional-conduct guidance,[18][19] and state privacy rules,[17] with the EU AI Act[8] and GDPR[11] added if you serve people in the EU.Evidence: a rule-to-control table.
  • Policy enforcementTurn the acceptable-use policy into settings: single sign-on, an approved-tool list, blocked endpoints.Evidence: the configuration that enforces each policy line.
  • Incident reportingDefine an AI incident (a wrong output someone relied on, data sent to the wrong place), who logs it, and when it triggers your breach procedure.Evidence: the incident log, including the empty months.
  • Audit trailsWho asked what, which documents were retrieved, which model version answered.Evidence: logs kept to the retention policy.
  • Scheduled reviewEach quarter, re-read the register, re-run the test sets, and check what changed in the law. Send the findings back to layer 1.Evidence: dated review minutes.

Closest NIST AI RMF function: Govern.[1] Related: what a local audit trail records.

Mandate and loop

The two parts the usual six-layer picture leaves out.

  • Accountable ownerOne person with authority over every layer. In a small practice this is a partner or the practice manager, not the IT vendor.
  • Acceptable-use policyOne page: which tools, which data may go into each, which uses need review.
  • Off-limits listThe uses the practice has decided not to attempt, written down so the question is not reopened every month.
  • Review calendarFixed dates for the layer 6 review, so it happens without an incident to prompt it.
  • Three triggers that reopen layer 1An incident. A failed evaluation. A change in the law, the model, or a vendor's terms.

NIST describes Govern as the function that runs through the other three.[1] ISO/IEC 42001 puts policy and responsibility ahead of technical controls.[3]

1 of 8

Four corrections to the usual picture

Someone has to own it

The usual diagram starts at inventory. An inventory with no owner is a spreadsheet nobody opens twice. NIST's AI Risk Management Framework places a Govern function across the other three (Map, Measure, Manage) for this reason.[1] ISO/IEC 42001 is built the same way: it is a management-system standard, so written policy and assigned responsibility come before any technical control.[3] In a small practice that means one named person with authority to switch a system off, and a one-page acceptable-use policy. The carousel draws this as the spine the six layers hang on.

It runs as a loop

The arrows in the usual picture point down and stop. In practice the audit layer produces findings: an incident, a failed test, a change in the law. Each one changes the inventory or a risk tier. Two examples from 2026: the EU moved its high-risk deadline from August 2026 to December 2027 in an amendment that took force six days before the original date,[9] and Colorado repealed and replaced its AI Act before the first version ever took effect.[16] A program that never returns to layer 1 describes last year's systems under last year's rules.

The legal layer is your rulebook

The usual picture lists the EU AI Act and GDPR. Both are European instruments.[8][11] A California medical practice meets other rules first: the HIPAA Security Rule,[12] and the state's disclosure requirement for AI-generated patient messages.[15] A law firm meets the ABA's and the State Bar of California's guidance on generative AI.[18][19] Which rules bind a given practice is a question for its attorney. The governance job is to write the answer down and attach each rule to a control someone can check.

You deploy models; you do not train them

Bias screening of training data, public benchmarks, and model cards assume you built the model. A practice running a published open-weight model against its own files has different exposures: which documents the retrieval index can reach, whether it respects folder permissions, and whether anyone tested the system on the practice's real work. OWASP's list of risks for LLM applications reads closer to that situation than a training checklist does. It names prompt injection, sensitive information disclosure, excessive agency, and vector and embedding weaknesses.[5] Fairness testing stays in the stack, sized to the risk tier. It matters wherever output informs a decision about a person.

THE PUBLISHER'S JOB YOUR JOB TRAINING DATA screened for bias YOUR DOCUMENTS reach + folder permissions PUBLIC BENCHMARKS leaderboard scores YOUR TEST SET questions from real work MODEL CARD the publisher's record YOUR MODEL RECORD version · hash · date
Each row pairs a check the model's publisher ran with the one that falls to you. Theirs covers the model. Yours covers what you connected it to.

What on-premises inference settles, and what it leaves open

Where the model runs changes some layers and leaves others untouched. It helps to be exact about which.

YOUR OFFICE STAFF PROMPT typed by someone on staff DOCUMENT INDEX retrieves passages MODEL ON YOUR GPU weights on your disk AUDIT LOG kept on your storage HOSTED MODEL vendor's terms apply outside route: only what you forward Inside the dashed wall, no outside company handles the prompt.
The solid path stays in the building. The dashed route leaves it, and carries only the prompts you choose to forward.

Settled by the architecture

  • The data path. With inference on a server in your office, a prompt and the documents retrieved for it travel across your own network to your own GPU and back. No outside company processes them, so the vendor-retention and vendor-training questions in layer 3 do not arise for that route.
  • Version control. Model weights are a file on your disk. They change when you replace the file. Layer 4 change control becomes something you schedule instead of something a vendor announces.
  • The audit trail. Logs sit on storage you control. Retention is a setting you choose and can show an auditor.

Left open

  • Retrieval permissions. A local model will quote a partner's personnel file to an associate as readily as a hosted one will, if the index ignores folder permissions.
  • Human review. Where the model runs has no bearing on whether a qualified person reads the output before it is used.
  • The outside route. If selected prompts are forwarded to a hosted frontier model, those prompts are back under a vendor's contract terms. The register has to record which route each use takes.
  • The server itself. It is now your equipment to patch, back up, and keep in a locked room.
INDEX IGNORES PERMISSIONS ASSOCIATE partner's HR file? ASSISTANT PARTNER HR here it is, quoted Read from a folder the asker cannot open. INDEX ENFORCES PERMISSIONS ASSOCIATE partner's HR file? ASSISTANT PARTNER HR you cannot open that Same rule as the file share.
Same question, same model, same locked folder. The only difference is whether the index checks who is asking.

The hardware and software behind this section: The Architecture Behind Private AI for Regulated Practices and the Private LLM Architecture reference. The rule IT CloudLink LLC applies to the outside route: Data Routing Policy.

Where to start

  1. Name the owner. One person, with authority to stop a system.
  2. List what is already in use. Give staff two weeks to report every AI tool they touch, including features inside software you already license.
  3. Tier the list by what a wrong answer would cost. Pause anything in the top tier that has no human review.
  4. Write the one-page acceptable-use policy: which tools, which data, which uses are off limits.
  5. Put the first quarterly review on the calendar.

The bodies behind the stack

The stack above is a synthesis. These are the organizations whose documents it rests on, grouped by how much force their output carries. Status was checked on October 6, 2026.

Standards and technical references

Voluntary. They supply the shared vocabulary and the control lists.

  • NIST (U.S. National Institute of Standards and Technology) Publishes the AI Risk Management Framework 1.0 (January 2023), organized as Govern, Map, Measure, Manage, and the Generative AI Profile, NIST AI 600-1 (July 2024). NIST states that the framework is being revised. Its Center for AI Standards and Innovation opened an AI agent standards initiative in February 2026.[1][2][25] Voluntary framework. The function names used on this page come from it.
  • ISO/IEC JTC 1/SC 42 The joint ISO and IEC committee for AI standards. ISO/IEC 42001:2023 sets requirements for an AI management system. ISO/IEC 42005:2025 gives guidance on AI system impact assessment. ISO/IEC 23894 gives guidance on AI risk management.[3][4] Voluntary. 42001 is written as requirements, so it can be audited against.
  • OWASP GenAI Security Project Maintains the Top 10 for LLM Applications, a community-built list of the security failures specific to systems built on language models.[5] Community reference. The working checklist for layers 3 and 4.
  • MITRE ATLAS A public knowledge base of tactics and techniques used against AI systems, modeled on MITRE ATT&CK.[6] Community reference. Source material for red-team exercises.

Intergovernmental bodies

They set the principles that national laws and standards borrow from.

  • OECD The OECD AI Principles, adopted in 2019 and updated in 2024.[21] Non-binding recommendation to member governments.
  • UNESCO The Recommendation on the Ethics of Artificial Intelligence, adopted in November 2021.[22] Non-binding recommendation to member states.
  • Council of Europe The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, opened for signature in September 2024.[23] A treaty. It binds the states that ratify it, not private firms directly.

Regulators and professional bodies

Binding where you fall in scope. Scope is a question for your attorney.

  • HHS Office for Civil Rights Enforces the HIPAA Privacy and Security Rules. The Security Rule sets administrative, physical, and technical safeguards for electronic health information. An overhaul proposed in January 2025 has not been finalized.[12][14] Binding on covered entities and business associates.
  • American Bar Association and the State Bar of California ABA Formal Opinion 512 (July 2024) applies the Model Rules on competence, confidentiality, communication, supervision, candor, and fees to generative AI tools. The State Bar's Practical Guidance (November 2023) does the same under California's rules.[18][19] Advisory guidance on rules that are themselves binding on lawyers.
  • California Legislature AB 3030, in effect since January 2025, requires a disclaimer and human-contact instructions on generative-AI patient communications about clinical information, with an exemption for messages a licensed provider has read and reviewed.[15] State statute. Health and Safety Code section 1339.75.
  • California Privacy Protection Agency Its CCPA regulations on automated decision-making technology, risk assessments, and cybersecurity audits took effect January 1, 2026. The automated decision-making requirements apply from January 1, 2027.[17] Binding on businesses covered by the CCPA.
  • Federal Trade Commission The Safeguards Rule requires covered non-bank financial institutions to keep a written information security program. It is not specific to AI, and it reaches any AI system that touches customer financial data.[20] Binding on covered financial institutions.
  • European Union: AI Office and data protection authorities The AI Act, Regulation (EU) 2024/1689, and the GDPR. A July 2026 amendment moved the obligations for stand-alone high-risk systems to December 2, 2027, and for AI embedded in regulated products to August 2, 2028.[8][9][10][11] Binding within its territorial scope.
  • Other U.S. states and the federal layer Colorado's SB 26-189, signed in May 2026, replaced the state's 2024 AI Act with a narrower law on automated decision-making, effective January 1, 2027.[16] There is no comprehensive federal AI statute. A December 2025 executive order directs federal agencies to challenge state AI laws, which remain in effect unless a court or Congress acts.[24] Unsettled. A reason to keep the quarterly review.

References

  1. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. nist.gov/itl/ai-risk-management-framework
  2. National Institute of Standards and Technology. AI RMF: Generative Artificial Intelligence Profile, NIST AI 600-1, July 26, 2024. doi.org/10.6028/NIST.AI.600-1
  3. ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system. iso.org/standard/42001
  4. ISO/IEC 42005:2025, Information technology: Artificial intelligence: AI system impact assessment. iso.org/standard/42005
  5. OWASP GenAI Security Project. OWASP Top 10 for LLM Applications, 2025 edition. genai.owasp.org/llm-top-10
  6. MITRE. ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. atlas.mitre.org
  7. Mitchell, M., et al. "Model Cards for Model Reporting." Proceedings of FAT* 2019. arxiv.org/abs/1810.03993
  8. Regulation (EU) 2024/1689 (Artificial Intelligence Act). eur-lex.europa.eu/eli/reg/2024/1689/oj
  9. Cloud Security Alliance. "EU AI Act's High-Risk Deadline: Deferred, Not Cancelled," research note on Regulation (EU) 2026/1744, 2026. labs.cloudsecurityalliance.org
  10. Orrick. "EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes," July 2026. orrick.com
  11. Regulation (EU) 2016/679 (General Data Protection Regulation). eur-lex.europa.eu/eli/reg/2016/679/oj
  12. U.S. Department of Health and Human Services. "The Security Rule," 45 CFR Part 160 and Part 164, Subparts A and C. hhs.gov/hipaa/for-professionals/security
  13. U.S. Department of Health and Human Services, Office for Civil Rights. "Guidance Regarding Methods for De-identification of Protected Health Information," 45 CFR 164.514. hhs.gov/hipaa/for-professionals/special-topics/de-identification
  14. Feldesman LLP. "OCR Delays Final Action on Proposed HIPAA Security Rule," 2026. feldesman.com
  15. California Assembly Bill 3030 (2024), Health and Safety Code section 1339.75. leginfo.legislature.ca.gov
  16. Colorado Senate Bill 26-189 (2026). leg.colorado.gov/bills/sb26-189. Summary: Norton Rose Fulbright, "Colorado enacts revised AI law," May 2026. nortonrosefulbright.com
  17. California Privacy Protection Agency. CCPA regulations. cppa.ca.gov/regulations. Summary: Thompson Coburn, "California's 2026 CCPA Regulations," January 2026. thompsoncoburn.com
  18. American Bar Association, Standing Committee on Ethics and Professional Responsibility. Formal Opinion 512, "Generative Artificial Intelligence Tools," July 29, 2024. americanbar.org (PDF)
  19. State Bar of California, Standing Committee on Professional Responsibility and Conduct. "Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law," November 16, 2023. calbar.ca.gov (PDF)
  20. Federal Trade Commission. Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314. ftc.gov/legal-library/browse/rules/safeguards-rule
  21. OECD. Recommendation of the Council on Artificial Intelligence (OECD AI Principles), 2019, updated 2024. oecd.ai/en/ai-principles
  22. UNESCO. Recommendation on the Ethics of Artificial Intelligence, 2021. unesco.org
  23. Council of Europe. Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, CETS No. 225, 2024. coe.int
  24. Ropes & Gray. "The White House Legislative Recommendations: National Policy Framework for Artificial Intelligence and Federal Preemption of State AI Laws," March 2026. ropesgray.com
  25. Cloud Security Alliance. "NIST AI Risk Management Framework: Agentic Profile," draft white paper, March 2026 (describes the NIST CAISI AI Agent Standards Initiative). labs.cloudsecurityalliance.org

IT CloudLink LLC builds and manages private, on-premises LLM infrastructure for healthcare, legal, and other regulated practices.

Contact IT CloudLink LLC

This page is a technical reference and not legal advice. Which laws apply to your practice is a question for your attorney.