Capstone: Building and Defending a US AI Compliance Program

One company, one multistate deployment, worked end to end: build the program on the NIST RMF spine, crosswalk one control set to ten regimes, run an LL144-grade bias audit, survive an incident with three regulator clocks running, and defend it all — privilege, cure periods, RMF defenses, and preemption scenario planning included.

Content current as of 2026-09.

Lessons

1. The brief: one company, every regime at once
2. One control set, ten regimes: the master crosswalk
3. Running the LL144-grade bias audit
4. TEVV, vendor teeth, and the night the incident hits
5. Defending it: privilege, cure periods, and the preemption endgame