Governing Claude in the Enterprise
AI Risk, Compliance, and Operational Controls for Anthropic's Platform
A field guide for risk, compliance, security and platform leaders deploying Claude in regulated environments, with fifteen reusable governance artefacts.
- Author
- Srinivas Bommena
- Edition
- First Edition
- Published
- July 2026
- Formats
- Kindle
- Length
- 399 pages
About this book
Your teams are already using Claude. The question your board, your auditors and your regulators will ask is simpler and harder: can you prove it’s under control?
Governing Claude in the Enterprise is a practitioner’s field guide for the people who have to answer that question: risk, compliance, security, legal and platform leaders deploying Anthropic’s Claude in regulated and high-stakes environments. It moves past principles and vendor assurances to the operational controls, evidence and accountability that governance actually requires.
Across fifteen chapters, the book follows one running case study, NovaCred, a fintech deploying Claude for credit decisions, and hands you fifteen reusable governance artefacts you can adapt directly: a platform-selection memo, a shared-responsibility matrix, a data-classification scheme, an RBAC and identity model, a system-prompt change-control policy, a monitoring and signal register, an AI incident-response plan, and more.
Inside you’ll learn how to
- Draw the shared-responsibility boundary between what Anthropic governs and what you must, and stop mistaking vendor safety for enterprise compliance.
- Treat Claude’s architecture as a governance surface: identity, provenance, decision boundaries, and the secret boundary that production credentials must never cross.
- Build monitoring, logging and incident response that survive an audit when the provider’s logs age out in days.
- Operationalise NIST AI RMF, ISO/IEC 42001 and the EU AI Act from one unified control set instead of four duplicated programmes (“govern once, map many”).
- Govern the next frontier, agentic AI, with coverage of the OWASP Agentic Top 10, Singapore’s IMDA governance framework and NIST’s agent-standards work.
This is not legal advice, and it never pretends a certificate equals compliance. It is the missing operating manual for turning “we use Claude” into “we govern Claude”, with the artefacts, controls and evidence to prove it.
Companion volume: Runtime AI Governance.
