Research and practitioner notes on governing AI in the real world — from ownership, evidence and human oversight to assurance, regulation and implementation across the UK, EU, US and India.
Traditional software controls still matter. AI adds uncertainty, data dependence, probabilistic behaviour, changing models, third-party dependencies and human-impact questions that ordinary software governance was not designed to answer on its own.
Read the insight →A practical operating model: know what AI you have, route use cases by context and risk, assign decisions, collect evidence, test controls, record exceptions and reassess when something material changes.
Read the insight →One is a certifiable management system standard, one is law, one is a voluntary framework with no certification. What each obliges, what a certificate does and does not prove, and how to build evidence once and map it to all three.
Read the insight →Every framework asks for evidence and few say what it has to look like. The five properties of usable evidence, what good looks like by area, why weak evidence passes, and why a missing artefact is a finding rather than a failure.
Read the insight →