Notes on governance, risk, and AI.
Practical writing for SMEs navigating compliance, risk, and AI governance — no jargon, no padding.
The Pinky-Swear Problem: Voluntary AI Governance Meets Its First Real Test
A 24-hour gap between a voluntary pledge from the major AI labs and an FTC probe into those same labs — and why a summer of rogue-agent incidents explains the difference.
AI Governance Just Went Live — And Most Boards Weren't Watching
Since August 2026 the EU, China, and a patchwork of US states are actively enforcing AI rules — but not the ones most compliance budgets were built around.
The Risk Register Nobody Reads (And How to Fix It)
Why most risk registers get built once and never opened again — and how to build one people actually use.
Your Chatbot Has an Attack Surface Too
Prompt injection, data leakage, and what happens once your AI assistant can actually take action.
Zero Trust Is Not a Product You Buy
Why the vendor pitching you a "Zero Trust box" is missing the point — and where an SME actually starts.
ISO 42001 in Plain English
What an AI management system actually requires — and why it matters more for SMEs than the ISO branding suggests.