Field notes
No maturity curves, no vendor scorecards. Each piece takes one hard question in AI governance, risk or assurance and answers it in a way you can act on this quarter.
Latest
All pieces
9 pieces
Adopting ISO 42001 after NIST AI RMF should add a view, not a backlog. What it takes to hold one internal control library and map every standard onto it.
A percentage is a weighted average of things that are not commensurable. Mapped, covered, partially covered, evidence pending and not assessed are the only honest states.
A deterministic gate is only useful if the verdict carries its reasoning, and if a PASS invalidated by later change raises new work instead of being quietly edited.
Versioned, hashed, reviewed, expiring. Why an evidence store that lets you overwrite a file is a liability rather than a convenience.
Licence checks, content pack delivery, model providers and telemetry are the four places an on-premise governance tool quietly assumes the internet. Each one is solvable.
A system owner who can approve their own risk acceptance has no governance at all. Hiding the button is not a control; refusing the request is.
Six requests that decide how an AI audit goes, and the records you need to have already been keeping before the engagement letter arrives.
A0 to A4 should change which controls become mandatory. If the field only appears on a dashboard, it is documentation rather than governance.
Where a model genuinely helps in a governance workflow, where it must be refused in code, and why the product works with no model configured at all.