Most organizations treat AI governance as a technology problem — hallucinations, prompt injection, model security. But the discussions that actually stall are rarely about technology. They stall because nobody has answered a simpler question: who owns and accepts the risk when AI enters a business process? Lessons from enterprise AI governance discussions across industries.

Most EU AI Act provisions apply from August 2, 2026 — and the Cyber Resilience Act's 24-hour vulnerability reporting follows on September 11. This post maps AI Act value-chain roles (General-Purpose AI (GPAI) provider, provider, deployer) onto the cloud AI trust-boundary patterns from earlier in this series, and shows why hosting choice changes your GDPR answer but not your regulatory one.

Why TLS 1.3 alone isn't enough in a post-quantum world. Explains Shor's algorithm, the Harvest Now Decrypt Later threat, NIST PQC standards, hybrid TLS deployment, and what the quantum timeline means for your cryptographic migration planning.

A 25-year history of TLS security failures — POODLE, BEAST, Heartbleed, DROWN — and what drove each protocol transition. Explains cipher suites, why TLS 1.2 is still everywhere, and why TLS 1.3 is a redesign rather than an upgrade. Includes the compliance table auditors actually use.

Microsoft Foundry reached general availability for Claude on June 29, 2026, adding a new Hosted on Azure option. Breaks down what actually changed, why Anthropic remains an independent data processor either way, and how that differs from Azure OpenAI's single-processor model — including who governs Zero Data Retention in each case.

Breaks down the split between the control plane and data plane in cloud AI platforms, showing how the same model can carry very different trust profiles depending on where inference actually runs. Looks at the limits of Zero Data Retention and why trust-boundary review has to be an ongoing process, not a one-time audit.

A practical walkthrough of how HTTPS actually secures a connection: the TLS handshake, certificate trust chains, and how symmetric and asymmetric encryption work together. Also covers what HTTPS does not protect, like the destination domain and IP address, and what compliance auditors actually check.

Explains how Multi-Geo in Power BI and Microsoft Fabric lets SaaS vendors keep customer workspace data in a specific region instead of the tenant's home region. Covers the licensing prerequisites, what metadata still stays home-region, and when a full multi-tenant architecture is needed instead.

Covers the advanced end of Azure key management: Bring Your Own HSM, neutral escrow models, and governance at scale across RBAC, rotation, and audit logging. Closes with a decision framework for choosing a key control model and a look at what comes next, from confidential computing to post-quantum cryptography.

A look inside Azure's encryption-at-rest implementation, from default Microsoft-Managed Keys to Customer-Managed Keys in Azure Key Vault and Bring Your Own Key. Explains how key protection levels and rotation policies affect compliance, and why key control matters for SaaS vendors.