Generative AI Development Services

Responsible Generative AI, Security and Compliance

Generative AI systems may be subject to a number of legal, regulatory and contractual requirements depending on their use case, sector, location, data and risk level. During discovery ChicMic Studios works with clients to surface key issues and embed appropriate controls in the generative AI architecture, development process and deployment plan.

• EU AI Act Generative AI applications may require risk classification, transparency, oversight by humans, technical documentation, monitoring and other precautions, depending on what a system is designed to do, who uses it and its market and risk category.
• GDPR and data-protection laws Processing of personal data for generative AI applications may also be subject to lawful processing, purpose limitation, data minimization, retention, user transparency, data-subject rights, and international data transmission safeguards.
• HIPAA and healthcare privacy requirements Healthcare generative AI apps that process protected health information may need appropriate administrative, technical, and contractual safeguards such as controls on access, auditability, data handling practices and appropriate vendor agreements. HIPAA and health information privacy standards.
• Financial-services regulations Generative AI used for fraud detection, lending, risk assessment, payments, financial advising or consumer choices may need explainability, documentation, oversight by humans, model validation, output review and safeguards against discriminatory results.
• SOC 2, ISO 27001, and client security standards Enterprise clients may require evidence of security controls at the organizational level, identity and access management, risk management, incident response, data governance, vendor management and AI-system oversight.
• Industry-specific and regional requirements Laws may also apply to generative AI applications in employment, education, biometrics, children’s services, critical infrastructure, government services, legal activities and other sensitive industries.