ISO 42001:2023 Audit & Control Checklist
The organization shall define and put in place a process to report concerns about the organization's role with respect to an AI system throughout its life cycle.
Operationalizing AI Guidance: A Reference Guide for Translating High-Level Goals into Practical Implementation
Building on CSET’s harmonized AI framework, this report collates actionable guidance from these resources into an easy-to-navigate format and connects the information back to core recommended practices, establishing a critical link between high-level principles and practical implementation details.
ISO 42001 + NIST AI RMF: The Practitioner Mapping Guide
ISO 42001 establishes the formal policies and roles. NIST AI RMF provides the practical, risk-based steps to identify and measure harms in your specific operational context. Sequencing both creates a system that is certifiable and resilient.
The AI Risk Repository: A Meta-Review, Database, and Taxonomy of Risks from Artificial Intelligence
We address this by creating the AI Risk Repository: a living database of 1,725 risks extracted from 74 existing taxonomies and frameworks. We organize these risks using two complementary classification systems.
NIST AI 800-4: Challenges to the Monitoring of Deployed AI Systems
Post-deployment measurement and monitoring is necessary (1) to validate that an AI system is operating reliably and as expected in real-world scenarios, (2) to track unforeseen outputs and drift, and (3) to identify unexpected consequences of integrating AI systems in new or changing contexts.
ISO/IEC AI Standards: Comprehensive Reference - Updated March 2026
A practitioner's map of published international standards for AI systems, covering foundational concepts, governance, trustworthiness, data quality, lifecycle management, computational approaches, use cases, and conformity assessment.
Governing Intelligence: Law, Privacy, Security, and Compliance in the Age of Artificial Intelligence
No universally accepted definition of artificial intelligence exists — a gap that carries direct consequences for regulation, compliance obligations, and regulatory scope. This textbook proposes the AI Governance Stack as its central organizing framework: a five-layer operational model.
AIGL Newsletter #22: Managing the Unexplainable
We may never fully understand how some AI systems arrive at their answers. Governance cannot wait for perfect explainability. The real test is whether organisations can define acceptable boundaries, detect when systems cross them, and respond when the machine surprises them.
AI Governance for Business: Scoping AI Use Cases and Managing Risks
AI risk management is the systematic and continuous application of management policies, processes and practices to the tasks of analysing, evaluating, controlling and monitoring risks throughout the entire lifecycle of an AI system.
The Dual Challenge of AI in Audit: Automating Assurance and Governing the Technology That Does It (Part 1)
Audit functions face a dual challenge: using AI to improve assurance while providing assurance over the AI systems themselves. The same technologies that improve analytical capability also introduce new risks relating to explainability, evidence integrity, data quality, privacy, and accountability.
A Security Field Guide to AI Tooling Visibility
AI tools now read and write code, search business data, run commands, change repositories, and call external systems. Across eight AI tooling sources, each chapter answers what the source records, what it misses, which fields matter, what the data can support, and where its limits begin.
Authoritative Guide to AI/ML-BOM
An ML-BOM (Machine Learning Bill of Materials) is a CycloneDX BOM document designed to address the unique complexities and risks of AI/ML systems. It provides a detailed inventory of all components, configurations, and processes involved in the development, training, deployment, and hosting
Forecasting AI Cyber Risks and Capabilities: Results of a 2025 Pilot Study
The forecasts show a consistent pattern: participants assessed baseline risks of catastrophic cyber harms in 2026 as low but non-negligible, and they expected some AI capabilities to substantially increase those risks, especially when AI lowers barriers for moderate-sophistication actors.
AI Threat Readiness Playbook: The 4-Pillar Operating Framework for Security Leaders
Frontier models can now autonomously discover zero-day vulnerabilities, generate working exploits, and chain complex attack paths. The time between a vulnerability being disclosed and being weaponized has collapsed. And the threat has moved up the stack
AI Security Checklist
Secure the Data. Protect the Model. Control Access. Monitor Every Decision.
AI Governance: From Director Expertise to Board Effectiveness
Between December 2021 and June 2025, the share of large- and mid-cap developed-market companies with at least one AI expert director grew from 15% to 25%. Yet only 14% of boards had effectively integrated that expertise as of mid-2025, meaning they had recruited the credential without deploying it.
Zero Trust for AI Agents: A security framework for deploying autonomous AI agents in the enterprise
When you evaluate any control in this document, ask a single question: does this make the attack impossible, or just tedious? Mitigations whose value comes from friction rather than a hard barrier degrade significantly against an adversary that can grind through tedious steps at scale.
Data Governance and AI Governance Maturity Assessment Checklist (Financial Services)
The assessment should be completed using a combination of management interviews, sample-based evidence review, control design assessment, control operating-effectiveness testing, system walk-throughs, and independent challenge. Scoring should be evidence-based and should not rely solely on managemen
OWASP Agentic Skills Top 10: Security Risks and Mitigations for Agentic Skill Ecosystems
Agentic skills are becoming first-class citizens of AI workflow: reusable bundles of progressive instructions, code, resources, and operational know-how that agents can discover, load, and execute. That makes them powerful, but it also moves risk into a new layer.
2026 NCSC AI Cyber Security Risk Assessment: Public Sector Deployment
AI fundamentally changes an organisation's risk profile. It expands the attack surface, increases data movement across systems, and introduces behaviour that can change over time as models are updated and interact with new data.
The AI Governance Practitioner's Manual: An Operational Playbook for Cross-Functional AI Risk, Law, and Compliance
AI is not a single decision; it is a stack of decisions: what data goes in, how the model learns, how it is wired into the business, how it is watched, and how it is proven. Governance must be a stack too. Every part of an AI system gets its own layer of controls, with its own owner and its own evid
Engineering a Culture of AI Security
AI security is rarely treated as a cultural problem. Most organizations manage AI risk with technical controls, and do very little about the risks that people introduce: shadow AI, blind trust in hallucinated output, unintentional IP leakage and more.
A Founder's Guide: ISO 42001 Cheat Sheet
ISO 42001 does not make your AI trustworthy. It makes your AI governance auditable, and that is the point. One warning: an ISO 42001 certificate is not solely EU AI Act compliance. It is evidence of governance, not a legal safe harbour.
Governing AI Agents: Palantir’s Perspectives on Agentic Governance
Mechanisms at the model level to ensure that AI Agents meet safety standards are insufficient. Implementing and maintaining those guardrails once models are deployed in the enterprise context are necessary.