Resources

What we have worked out, published in full.

What we publish about governing AI agents — writing, documents and recordings. No email wall; if it is here, you can read or watch it.

Upcoming webinar

AI: What you kind of need to know!

In this Webinar, we will share a summary of our learnings in developing an agentic platform, transforming a traditional SaaS platform to a powerful AI Asset driven solution, and understanding the true FinOps picture of an AI transformation journey. We'll touch on the basics or fundamentals behind all AI: the math that AI relies on, explain how the machine actually works, introduce the modern stack and end by touching on AI ethics, governance and deployment. Should be a fun, informative session with shared lessons learned.

Wednesday 9 December 2026 · 10:00–11:00 MST

With Robin Beetge

Articles
OECD AI Principles and the Soft Law Behind AI Rules
The OECD AI Principles are non-binding, yet the EU AI Act took its definition of an AI system from them. Why soft law writes the sentences hard law is made of, and how UNESCO, the UN panel and the G7 process fit. The Eight Tiers, part 8 of nine.
October 2026 · 9 min read
Articles
OWASP LLM Top 10 (2026) and the AI Security Stack
The OWASP LLM Top 10 ranks the most critical security risks in LLM applications. In the 2026 edition, Excessive Agency moved from sixth to third. What changed, where MITRE ATLAS fits, and how security frameworks meet EU AI Act Article 15. The Eight Tiers, part 7 of nine.
October 2026 · 8 min read
Articles
NIST AI RMF Explained: Four Functions, 72 Subcategories
The NIST AI RMF organises AI risk management into four functions — Govern, Map, Measure and Manage — across 19 categories and 72 subcategories. It is voluntary, yet it doubles as an enforcement safe harbour under Texas TRAIGA and a de facto reference for US federal agencies. How it works and how it crosswalks to ISO 42001. The Eight Tiers, part 6 of nine.
October 2026 · 8 min read
Articles
ISO 42001 Certification: What It Actually Proves
ISO 42001 certification proves one thing: an accredited auditor found your AI management system conformant. What Annex A actually asks for, how ISO/IEC 42005 and 42006 fit around it, and why a certificate is not EU AI Act conformity. The Eight Tiers, part 5 of nine.
October 2026 · 9 min read
Articles
NAIC AI Model Bulletin: What Insurers Must Document
The NAIC AI Model Bulletin requires insurers to keep a written AI Systems Program covering the whole AI lifecycle — governance, model validation, third-party oversight. Adopted by 29 US jurisdictions and tested through market conduct examination, not a new filing. What it is, what it is not, and what to document first. Vertical 01: Insurance.
September 2026
Articles
The AI Rules Your Regulator Already Enforces
Sectoral regulators are enforcing AI rules through the supervisory machinery they already have — the NAIC AI model bulletin in insurance, SR 26-2 in US banking, the FDA's revised clinical decision support guidance and HTI-1 in health IT. If you operate in a regulated industry, at least one of them binds you today. The Eight Tiers, part 4 of nine.
September 2026
Articles
US State AI Laws: Where the Obligations Actually Are
There is no comprehensive US federal AI statute, so the enforceable obligations sit at state level — Texas, California, Colorado and a handful more. Which laws actually bind, and the jurisdiction question most trackers get wrong: reach follows your users, not your headquarters. The Eight Tiers, part 3 of nine.
September 2026
Articles
The First Binding International AI Treaty, and Why Almost Nobody Is Watching It
The Council of Europe Framework Convention on AI is the only binding international AI treaty in existence, and the EU became its first party in May 2026. Treaties bind states, not companies, which makes this tier easy to ignore and expensive to have ignored. The Eight Tiers, part 2 of nine.
September 2026
Articles
Only a Handful of Jurisdictions Have a Comprehensive AI Law. Here's Why.
As of September 2026 only five comprehensive AI statutes are in force worldwide. What each one actually demands, why the list is so much shorter than the noise suggests, and the near misses that will lengthen it. The Eight Tiers, part 1 of nine.
September 2026
Articles
Hundreds of AI frameworks distilled into eight
Ask how many AI frameworks exist and the answer runs from five to a thousand, depending on what you count. Sort them by what they actually do to you and the fog clears: eight kinds of instrument, twelve requirements, one programme. The opener to a nine-part series.
September 2026 · PDF
Whitepapers
The 2027 Deadline Trap
Regulation (EU) 2026/1744 moved the Annex III deadline to 2 December 2027 — and left four obligation sets exactly where they were. What changed, what did not, the month nobody diarised, and what to do in the next ninety days.
September 2026 · PDF
Articles
I Built My Own AI Degree. It Led Me Somewhere I Didn't Expect.
A year spent rebuilding an AI curriculum from three universities' syllabi kept ending at the same door: who is accountable when the thing acts? Eight kinds of framework, twelve shared requirements, and why we built laibrary.
August 2026

What we have worked out, published in full.

AI: What you kind of need to know!

OECD AI Principles and the Soft Law Behind AI Rules

OWASP LLM Top 10 (2026) and the AI Security Stack

NIST AI RMF Explained: Four Functions, 72 Subcategories

ISO 42001 Certification: What It Actually Proves

NAIC AI Model Bulletin: What Insurers Must Document

The AI Rules Your Regulator Already Enforces

US State AI Laws: Where the Obligations Actually Are

The First Binding International AI Treaty, and Why Almost Nobody Is Watching It

Only a Handful of Jurisdictions Have a Comprehensive AI Law. Here's Why.

Hundreds of AI frameworks distilled into eight

The 2027 Deadline Trap

I Built My Own AI Degree. It Led Me Somewhere I Didn't Expect.

Solutions

Govern

Orchestrate

Remediate