Pillar 05 · Govern
The amended NYDFS Part 500 sharpens the CISO’s board-reporting duty, the senior certification and the 72-hour notification. These are accountability requirements a board must oversee, not delegate and forget.
A board-approved autonomy policy that lives in a document changes no agent behaviour. Here is how to encode an autonomy classification as runtime rules that decide, per action, whether an agent may auto-execute, must ask a human, or is blocked outright.
Meaningful human oversight under AI Act Article 14 is an interaction-design and control-flow problem. Build override, stop and escalation into the system, not the SOP.
The PRA’s SS1/23 model-risk principles were written for traditional models but now have to cover AI and machine learning. What that means for your inventory, validation and monitoring, and what a supervisor will expect to see.
The Article 27 fundamental rights impact assessment is a structured artefact, not an essay. Here is how to turn it into a schema-driven template teams can complete, version per deployment and defend.
An ISO 42001 AI management system is only auditable if its Annex A controls map to running checks. Treat the control set as a code-backed library, not a binder.
“Products with digital elements” sounds like it means smart devices and IoT gadgets. Read the Cyber Resilience Act’s actual definition and the scope is far wider — wide enough that a board assuming the CRA is someone else’s problem is very often wrong, and wrong in a way that only surfaces once a product is …
NIS2 and the CRA are frequently discussed as if they’re the same regulatory push wearing two names. They regulate two entirely different things, aimed at two entirely different actors — and an organisation that’s mapped one against its obligations has often mapped nothing useful against the other. I’ve written separately about NIS2’s essential-entity obligations and …
Ask a compliance team what the AI Act requires and you get articles and annexes. Ask the engineering team building the actual system and you get a shrug, because nobody has translated “conduct a fundamental rights impact assessment” into a sprint they can actually plan. That translation gap is where AI Act compliance programmes quietly …
Most technology strategy documents are unread by design. Forty pages, a dozen slides of architecture diagrams, an executive summary nobody wrote last because nobody was forced to compress the argument first. A strategy that can’t fit on two pages usually isn’t a strategy — it’s an inventory wearing a strategy’s title. The length isn’t the …