Internal documents that happen to be published.
← Latest- / 112 August 2026
What banks are actually being asked to build right now
TL;DR: Two of the world's most powerful financial regulators publicly admitted, six days apart, that the governance framework for autonomous AI in regulated financial services doesn't exist yet. Firms that treat this as a compliance retrofit will spend 2027 explaining their certifications. Firms that treat it as an architecture problem will have the substrate in place before the rules land. * On 23 July 2026, the Bank of England's Deputy Governor signalled that agentic AI may require purpose-b
- / 1231 July 2026
Trust in AI is behavioural evidence, not code review
TL;DR: You can't trust an AI system by reading its documentation. Trust in AI comes from observed behaviour, not policy papers. The only artifact that proves your governance model works is a refusal log. Most regulated firms don't have one. * Agentic AI takes actions in production. The failure mode is behaviour that's already happened. * Regulators are now asking for demonstrated behaviour, not documentation. * A refusal log is the only evidence that policy is enforced, not just written. *
- / 134 July 2026
Your AI Policy Doesn't Fire When Your Agent Acts
I walk into firms with AI policies sitting in SharePoint. They get cited in board decks. They show up in audit binders. Then a model makes a decision, moves money, drafts client output, and the policy watches from the shelf. That gap is a wiring problem. Prose does not intercept a call. Prose does not sign an evidence record. Prose does not refuse an action because a control was not satisfied. The Difference Between a Document and a System A governance document describes what should happen
- / 1426 June 2026
The liability doesn't move: why AI governance can't be delegated to IT
I've watched this pattern repeat across financial services, investment operations, and regulated industries: the board approves an AI initiative, leadership assigns it to IT, and everyone assumes the governance problem is solved. It isn't. The legal accountability for AI decisions sits exactly where it always has—with the board, the company, and the individuals who deploy the system. The software can't be sued. The vendor can't absorb your liability. The AI can't appear in court. This isn't a
- / 1524 June 2026
How to make 'never' mean something: the enforcement problem in AI governance
I've been building AI governance systems for regulated environments where failure isn't just expensive. It's existential. The hardest part isn't writing the rules. That's the easy part. You sit down, map the regulatory requirements, identify the prohibited behaviors, document the constraints. CPS 234 says this. ISO 42001 requires that. The EU AI Act prohibits these specific practices. Done. The hard part is making those rules enforceable at runtime. Not aspirational. Not documented in a poli
- / 1622 June 2026
If you can't name the fear, you're not ready for the tool
I've watched organizations rush AI deployment like it's a competitive sprint. The urgency is real. The preparation is not. The conversation always starts the same way: "We need AI." I ask what they're trying to achieve. The answer is usually a category, not an outcome. "Efficiency." "Innovation." "Staying competitive." These aren't drivers. They're placeholders for thinking that hasn't happened yet. The diagnostic question most organizations skip Before you touch the technology, answer thre
- / 1719 June 2026
The void that opens when you can't explain what happened
I've watched organizations lose millions because they couldn't answer a simple question: why did you decide that? Not what did you decide. Not what was the outcome. Why. The decision was made. The system executed. The output was delivered. But the reasoning that connected input to action disappeared the moment the session closed. What's left is a black hole where accountability should be. Auditability is not memory Most people treat auditability like a storage problem. Keep the data. Archi
- / 1815 June 2026
Trust is behavioral evidence, not code review
You can't trust an AI system by reading its documentation. You can't trust it by reviewing its training data, auditing its architecture, or examining the policy framework someone wrote in a Google Doc six months ago. Those artifacts tell you what the system is supposed to do. They don't tell you what it actually does when the constraints matter. Trust in AI is built the same way trust in humans is built: through repeated, observable behavior that demonstrates adherence to principles under pressu
- / 1912 June 2026
How I govern AI agents using the same framework I use for employees
Most organizations treat AI governance as a new problem requiring new frameworks. I don't. I treat an AI session the same way I treat an employee. You give that employee roles and responsibilities. You give them scope. You put policies and controls around how they do their work. Then they use their know-how to get from A to B. A to B is what you measure. How they get from A to B—as long as they're within the bounds—the employee's good to go. The governance gap is organizational, not technolo
- / 209 June 2026
The model layer is done — what you build around it is everything
I need to be direct about something. Most organizations haven't processed this yet. The race to pick the right AI model is over. The capital needed to unseat any big player is astronomical. Yet XAI built GPT-5-class capability in under 12 months. DeepSeek achieved similar results in weeks with a fraction of the budget. Within 30 days, every major Chinese lab matched it. The moat is not the model. It never was. All the benchmarks show minute differences. Give Claude and GPT the same prompt,