LLM compliance — seven frameworks, one matrix
SOC 2 Type II
B2B SaaS baseline
6-12 months operated controls
Type I is a starter, not a gate
HIPAA
BAA required for PHI
Bedrock, Azure, Vertex, OpenAI, Anthropic
all provide BAA
GDPR
real-time PII redaction
post-processing not defensible
Clearview AI €30.5M (2024); OpenAI €15M (2024, overturned)
PCI-DSS
payment-data scope
config + contracts
for AI-interaction layer
EU AI Act
· in force August 1, 2024
· high-risk enforcement August 2, 2026
· fines up to €35M or 7% global turnover
· risk tiers: unacceptable / high / limited / minimal
most B2B LLM SaaS is limited-risk
Colorado AI Act
· effective June 30, 2026 (delayed)
· impact assessments
· right to appeal AI decisions
· Virginia similar for credit / employment
ISO 42001
AI governance
risk mgmt
transparency
human oversight
pairs with ISO 27001
cross-framework mapping — one control satisfies many
access logging: ISO 27001 A.5.15-18 · GDPR Art. 32 · HIPAA §164.312(a) · SOC 2 CC6
encryption in transit: ISO A.8.24 · GDPR Art. 32 · HIPAA §164.312(e) · PCI Req. 4
audit log retention: SOC 2 CC7 · HIPAA §164.312(b) · ISO A.8.15
reference profile — OpenAI 2026
SOC 2 Type 2 · ISO/IEC 27001:2022 · ISO/IEC 27701:2019 · GDPR · CCPA
HIPAA (BAA) · FERPA · PCI-DSS (ChatGPT payments)