- Essays··8 min read
The Controls You Cannot Descope
ISO/IEC 42001 certification documents the system an auditor reviewed, not the one running in production today. Working through the standard's 38 controls, each one reveals the same structural gap: a management system written against a fixed architecture, for a product that shipped weekly.
iso-42001eu-ai-actai-governanceenterprise-aiRead - Essays··8 min read
The Certificate You Did Not List
Enterprise procurement teams are embedding ISO 42001 status into vendor questionnaires ahead of the EU AI Act's August 2026 enforcement milestone — and deals are stalling when that field comes back empty. The pattern mirrors how SOC 2 became a contract gate a decade ago, but the timeline is compressed to eighteen months rather than five years. Vendors without an auditable AI management system are not losing on price; they are failing the first screening before negotiation begins.
iso-42001ai-governanceeu-ai-actenterprise-procurementRead - Essays··10 min read
What Can You Actually Test
The FCA's August 2025 review of algorithmic trading controls at ten principal firms found significant variation in compliance sophistication — but the structural problem is older than the review. Attestation requires a compliance officer to certify what an algorithm does when she cannot read the code, testing covers yesterday's scenarios, and surveillance measures what someone thought to calibrate. The FCA has named the gap; the attestation merely documents that the firm knows it exists.
algorithmic-tradingfinancial-regulationcompliancemarket-surveillanceRead - Essays··9 min read
The AI Act enforcement date nobody prepared for
On 2 August 2026, national market surveillance authorities across the EU began enforcing Article 4 of the AI Act, the staff AI literacy obligation that has technically been in force since February 2025. Most European universities have confused talking about AI with ensuring their staff can actually handle it. The first penalty will almost certainly arrive as an aggravating factor when a high-risk system is found deployed without documented staff training, rather than from the literacy clause alone.
eu-ai-actai-literacyhigher-educationai-regulationRead