Skip to content

GC

For general counsel: liability, record, and what to put in writing.

Shadow AI: discovery and controlShadow AI is deployer use you have not listed. Hunt with the sensors you have. Bin every finding. Do not invent a percentage.
What a board should ask about AIFifteen questions a director can ask without a demo. If the answers need adjectives, the company does not govern AI yet.
Prompt injection: a CISO playbookInjection is the method. The tool budget is the cause. Six controls you can show, and a test that measures tool calls — not manners.
ISO/IEC 42001 explained for the board42001 is how you govern AI, not how you bless a model. Read the scope. Keep the Act on the calendar.
Who is liable when an AI agent acts?An agent has no legal personality. Provider, deployer, product liability, and ordinary agency decide who pays — and a jailbreak does not change that.
What the EU AI Act requires in 2026–2027The Act is already live. High-risk duties moved. Here is what each seat owes now, and what 2027–2028 actually changed.

Put AI to work. Keep control of what matters.

Five engagements. Start with the problem in front of you: the architecture, one department, the whole organization, the stack you already run, or the work after launch.

Architecture ReviewSee what is running, where control is thin, and what has to change before you invest further.

Department DeploymentGoverned AI for one department and one real use case, on infrastructure you control.

Enterprise RolloutOne governed stack across the organization, on infrastructure you control.

Governance OverlayClearer controls and a verifiable record on the stack you already run.

Managed OperationsHardening, training, and engineering after launch, scoped to the engagement.