Reference material on governing AI agents in production, written from building it. No vendor abstractions: what the obligations actually require, what the implementations get wrong, and what auditors check.
Article 14 requires human oversight of high-risk AI systems. What that means in practice, what counts as evidence, and what auditors look for.
7 min readMost organisations have more AI agents in production than anyone has written down. How to discover them from telemetry you already have.
6 min readThe difference between logging what your AI agents did and being able to prove it. Hash chaining, independent verification, and what auditors check.
7 min readWhat belongs in an AI system inventory, why "a spreadsheet of models" is the wrong shape, and how to keep it accurate as agents change.
6 min readEnforcement-first AI governance stalls because nobody will put an unproven gate in a production path. Monitor mode is how deployment actually happens.
5 min readArticle 50 requires you to tell people when they are dealing with AI. What it covers, who it binds, and what a compliant disclosure looks like.
6 min readAI agents are non-human identities that act on behalf of humans. Why the usual service-account model breaks, and what an agent identity needs to carry.
7 min readAgents are usually given the permissions of the engineer who built them. How to scope agent access to data and tools without breaking the agent.
7 min readA log you can edit proves nothing about the past. How hash-chained audit trails work, what they do and do not guarantee, and how to verify one.
6 min readISO/IEC 42001 is the certifiable standard for AI management systems. What it asks for, how it differs from 27001, and what evidence certification needs.
7 min readPrompt injection cannot be reliably filtered. Why the durable defence is limiting what a compromised agent is able to do, not detecting the attack.
7 min read