Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
NIS2 took effect at the Member State level by October 18, 2024. The directive covers essential and important entities across 18 sectors. AI used in those operations falls under Article 21 cybersecurity risk management and Article 23 incident reporting. Audit trail expectations are operational.
Read post →AI governance audits turn on per-decision evidence. The auditor asks who initiated each request, what data was involved, what policy applied, and what the outcome was. Application logs collapse under those questions. Article walks through what an audit actually examines and the architecture that survives it.
Read post →AI governance fails when no single role owns the per-decision audit trail. The CISO, CRO, General Counsel, CTO, and platform engineering each hold a slice. Article walks through the seven stakeholder roles, what each owns, and where the handoffs break in practice.
Read post →Most AI governance policies are written for the auditor but cannot be evaluated at the request layer. A policy that lacks classification rules, identity definitions, and enforcement decision points is prose, not control. Article walks through what the policy has to specify to be enforceable.
Read post →AI model governance fails when it sits at the model registry layer alone. Model cards and versioning catalog the asset. Per-request enforcement governs how the model is actually used. Article walks through the runtime layer most model governance programs leave out.
Read post →AI data governance fails when the classification engine runs on documents and not on prompts. The data lake is sorted, the AI request path is not. Article walks through the prompt-level classification, lineage, and disclosure architecture that satisfies the regulators asking new questions about model inputs.
Read post →AI governance software splits into policy-building, inventory, and runtime enforcement. Most products in the category cover policy and inventory and leave runtime evidence to whatever the engineering team builds. Article walks through the architectural layers and what to ask vendors before signing.
Read post →AI governance training fails when it gets delivered as a single all-hands course. Each role inside the enterprise needs different content. Article walks through the role-specific training tracks the regulators and auditors expect, and where the curriculum meets the runtime evidence requirement.
Read post →AI compliance certification has shifted from a nice-to-have to a procurement gate. Customers ask vendors for ISO 42001 or NIST AI RMF alignment, SOC 2 with AI extensions, and per-decision audit evidence. Article walks through what to prepare, in what order, and where each certification meets the runtime evidence requirement.
Read post →AI ethics committees set principles. AI governance translates those principles into per-decision enforcement and audit records. Article walks through the seam between the two functions and what each one has to produce so a regulator can trace a principle to the decisions made under it.
Read post →Generative AI returns text. Agentic AI takes actions in systems of record. The shift moves the security boundary from content moderation to authorization. Most enterprise deployments still treat agentic AI as if it were a chatbot, and the audit trail collapses the first time an agent writes to a database.
Agentic AI workflows chain LLM calls across tools, data stores, and other agents. Most deployments authenticate the human at the front door and run the rest of the chain on shared service credentials. The audit trail collapses by the second hop.