Match each compliance regime to the concrete guardrail control it forces

Different compliance regimes force different concrete controls on an LLM deployment. The right mental model is each regime has a small number of architectural requirements that the safety stack must satisfy directly, generic safety claims do not substitute. - **HIPAA-safe deployment.** You must use **BAA-covered model endpoints** (the cloud provider signs a Business Associate Agreement) and you must redact PHI (Protected Health Information) at the input and on any trace or log export. Anthropic Claude on AWS Bedrock and Azure OpenAI Service both publish HIPAA-eligible configurations. - **FedRAMP-safe deployment** (US federal workloads). Inference must run inside an **authorised boundary** (FedRAMP Moderate or High), crypto must be FIPS-140 validated, and audit logs must be immutable. This is why FedRAMP-authorised LLM offerings (AWS GovCloud Bedrock, Azure Government, GCP Assured Workloads) are a separate sales motion from commercial Bedrock or OpenAI. - **SR 11-7** (US banking model risk management). The Federal Reserve guidance for banks requires **independent model validation**, documented limitations, and ongoing performance monitoring. For LLM deployments, this means a model risk management framework with periodic validation reports. - **SOC 2 Type II.** Auditor wants **evidence of operating effectiveness** over a 6-12 month period. Every guardrail decision must be logged with a reviewable trail. Immutable log storage (S3 object lock, equivalent) is the standard pattern. - **GDPR Article 22.** The right not to be subject to solely automated decision-making. Significant decisions (credit, hiring, benefit eligibility) require human in the loop or the user must be able to request human review. The pattern is that each regime maps to a distinct architectural commitment. Generic safety wording does not satisfy any of them.

Compliance regimes force **concrete architectural controls** that an LLM safety stack must implement directly. Five common regimes and the controls they impose: - **HIPAA**: requires a Business Associate Agreement with any third party processing PHI, plus PHI redaction at input and trace export. The 2026 pattern is Claude Opus 4.7 on AWS Bedrock or Azure OpenAI Service under BAA, with Bedrock Guardrails' sensitive-information filter or Azure AI Content Safety PHI detector at the gateway. Log exports to Langfuse or Datadog need a re-redaction pass before retention. - **FedRAMP**: requires inference inside a FedRAMP-authorised boundary (Moderate for most agency workloads, High for sensitive ones). FIPS-140 validated cryptography on all in-transit and at-rest data. Immutable audit logs with retention policies tied to the System Security Plan. This is why GovCloud / Azure Government / GCP Assured Workloads are separate offerings, and why an LLM stack built on commercial Bedrock does not meet FedRAMP regardless of how good the rails are. - **SR 11-7**: the Federal Reserve's banking model risk management guidance. Requires independent validation of any model used in a banking decision, documented limitations and assumptions, and ongoing performance monitoring. LLM deployments need a model risk management framework with a validation team separate from the development team, periodic re-validation, and documented out of scope use cases. - **SOC 2 Type II**: the auditor wants evidence the controls operated effectively over the audit period (typically 6-12 months). Every guardrail decision is logged immutably, every config change is reviewed and approved, every incident is documented. The control is not the rail itself; the control is the evidence chain. - **GDPR Article 22**: the right not to be subject to solely automated significant decisions (credit, employment, benefits).