Pillar 01 · See
A software SBOM captures your libraries but says nothing about the model, its weights or its training-data provenance. Here is how to build a machine-readable AI bill of materials that answers what model, trained on what data, is running where.
SEC, HIPAA, NYDFS, CCPA and CIRCIA all presuppose you know your systems and data flows. Build one governed system-of-record inventory and serve every US regime from it.
The HIPAA NPRM would require a maintained technology asset inventory and network map of every system touching ePHI. Most providers cannot produce one, because it is a data-model problem, not a documentation exercise.
Crossing MiCA’s significance thresholds moves an ART or EMT issuer under EBA supervision with heavier duties. Instrument the trigger metrics so the transition is planned, not a supervisory ambush.
The final NYDFS Part 500 tranche made a maintained asset inventory and expanded MFA mandatory on 1 November 2025. Here is how to build and evidence both.
You cannot migrate cryptography you cannot see. A hands-on build for automating discovery of algorithms, keys and certificates into a CycloneDX CBOM that stays current.
An AI inventory only earns its keep when each record maps to a risk tier and carries the fields the EU AI Act obliges you to produce. Here is the schema, designed backwards from the obligations.
Walking into an organisation on day one and being asked “so, how are we doing” is the single most common moment in fractional CTO work, and it’s also the moment where a wrong first move costs months. There’s no existing context, no institutional memory of past decisions, and a genuine risk of either taking too …
Shadow IT used to mean a marketing team quietly signing up for an unapproved SaaS tool. It now means a non-technical employee, using a low-code agent builder, quietly wiring together a workflow that reads customer data, calls an external API, and takes automated action — with no code review, no security review, and no one …
The technology due-diligence checklist most acquirers still use was written for a world of static software estates. It asks about the codebase, the infrastructure, the technical debt. It does not ask, in most current versions I’ve seen, what AI agents the target company runs, what those agents can actually do, and what happens to that …