- Essays··8 min read
The Certificate You Did Not List
Enterprise procurement teams are embedding ISO 42001 status into vendor questionnaires ahead of the EU AI Act's August 2026 enforcement milestone — and deals are stalling when that field comes back empty. The pattern mirrors how SOC 2 became a contract gate a decade ago, but the timeline is compressed to eighteen months rather than five years. Vendors without an auditable AI management system are not losing on price; they are failing the first screening before negotiation begins.
iso-42001ai-governanceeu-ai-actenterprise-procurementRead - Essays··12 min read
The Orphan Line Item
The EU AI Act's high-risk AI obligations became enforceable in August 2026 with no harmonised standards published and almost no notified bodies designated — the infrastructure the regulation assumed would exist. What arrives instead is a bill finance did not forecast: third-party conformity assessment at €50,000–150,000 per system, months-long queues for notified-body slots, and recurring annual costs at 20–40% of initial spend. The compliance deadline has moved; the invoice has not.
eu-ai-actregulatory-compliancenotified-bodiesconformity-assessmentRead - Essays··8 min read
The Agents You Cannot Name
Most enterprises deploying AI agents cannot list what is running, who approved it, or what it costs: a governance gap that is today's operating environment, not a future risk. Agentic workflows trigger ten to twenty LLM calls per task, and token volumes have grown sixty-fold since 2023. The agents you cannot name are the ones that will fail an audit, breach a data policy, or exhaust months of budget because nobody set a spend limit.
ai-governanceagentic-aienterprise-aishadow-aiRead - Essays··11 min read
The Guardrail You Can Audit
The EU AI Act's Article 12 logging requirement is an architectural obligation, not a monitoring one. Guardrails embedded inside the application produce audit evidence the application controls; guardrails deployed as a gateway produce records the application cannot reach. That distinction decides compliance, and organisations retrofitting the wrong architecture will find the fix costs three to five times what building it correctly would have.
eu-ai-actai-guardrailsaudit-loggingcompliance-architectureRead - Essays··11 min read
The agentic AI carve-out: why US and EU regulators are writing rules neither can enforce
The Federal Reserve placed agentic AI outside its model-risk framework in April; the European Commission issued transparency guidance two weeks before enforcement began in August. For banks operating across both jurisdictions, the collision is immediate and the governance gap is real. The first regulatory action will likely come for failing to document why deployment was safe at all, rather than for deploying these systems badly.
agentic-aifinancial-regulationmodel-riskeu-ai-actRead - Essays··9 min read
The AI Act enforcement date nobody prepared for
On 2 August 2026, national market surveillance authorities across the EU began enforcing Article 4 of the AI Act, the staff AI literacy obligation that has technically been in force since February 2025. Most European universities have confused talking about AI with ensuring their staff can actually handle it. The first penalty will almost certainly arrive as an aggravating factor when a high-risk system is found deployed without documented staff training, rather than from the literacy clause alone.
eu-ai-actai-literacyhigher-educationai-regulationRead - Essays··9 min read
The model-risk carve-out: why US banks got a temporary reprieve from agentic AI oversight while EU lenders face their deadline
SR 26-2, the Federal Reserve's updated model-risk guidance, carves generative and agentic AI out of supervisory scope. The carve-out is a placeholder while regulators decide what replaces SR 11-7. The EU AI Act's high-risk obligations arrive on 2 August. For multinational banks, the result is a structural supervision paradox: US headquarters has time but no clarity; European subsidiaries have clarity but no time.
model-riskagentic-aieu-ai-actbanking-regulationRead - Essays··7 min read
The Credentialing Question
The European Commission has published an AI literacy framework for schools but has not resolved the question that actually moves labour markets: which credentials count, against what standard, and who recognises them across member states. With EU AI Act enforcement beginning in August 2026, private vendors are filling the compliance vacuum faster than any public body can audit, and may end up setting the standard by default.
eu-ai-actai-literacycredentialingeuropean-higher-educationRead - Essays··10 min read
We finally have a definition · it's still half the problem
The EU-OECD AI Literacy Framework, released 18 June 2026, is the most coherent curriculum structure of its kind: four domains, 19 competences, offline adaptations for under-resourced schools. It does not credential, fund teacher upskilling, or close the 9.7-million ICT specialist gap the EU's Digital Decade requires by 2030. Article 4 of the AI Act has obligated staff training since February 2025. The framework is guidance rather than law, and the enforcement clock is already running.
ai-literacyeu-ai-actdigital-skillspanoraimaRead - Essays··7 min read
Both regulators blinked · the gap sits exactly where the agents live
Two of the most consequential financial supervisors stepped back from AI oversight inside eight weeks. The retreat lands precisely on the generative and agentic systems that worry me most. The regulators blinked. The risk didn't even slow down.
model-riskai-regulationeu-ai-actagentic-aiRead - Essays··7 min read
The Cornell Paper Is Not a Cheating Story
The Cornell paper will be read as a cheating story all summer. What it actually contains is the first peer-reviewed admission, in a journal of record, that the most important thing universities sell has lost some of its meaning.
higher-educationassessment-reformeu-ai-actai-literacyRead - Essays··7 min read
Three Clocks Ticking on the Same AI Quarter
Three deadlines are converging on the same AI quarter. One is set by treaty, one by physics, one by the next insurance renewal. Most boards are tracking the first, glancing at the second, and have never heard of the third.
eu-ai-actdata-centre-powerai-liability-insuranceai-governanceRead - Essays··7 min read
The AI Rulebook Is Now a Customs Form
The last forty days of AI regulation were barely about AI. They were about ports, subsidiary structures, export taxes and chips that triangulate their own location. The rulebook is now a customs form.
ai-regulationexport-controlseu-ai-actai-sovereigntyRead - Essays··8 min read
Two Regulators Blinked. The Agent Fleet Did Not.
Two regulators blinked on the AI question in a single five-month window. The largest banks did not stop deploying. The gap between those two facts is the most important live risk in financial services right now.
model-risk-managementagentic-aibank-supervisioneu-ai-actRead - Essays··8 min read
Brussels spent one fortnight telling teachers to use AI, and to be careful it isn't illegal
Inside thirteen days Brussels told teachers to adopt AI, delayed the rules governing the riskiest classroom uses, and only then began explaining what those rules mean. Three workstreams, one fortnight, no shared calendar.
eu-ai-actai-in-educationhigh-risk-classificationai-literacyRead - Essays··8 min read
Three flags, one substrate
Three weeks of racks, export approvals, and merger announcements turned the sovereignty debate from a slide into a bill of materials. It comes down to one supplier line, and the cleanest framings on both sides fall apart against it.
ai-sovereigntycompute-supply-chaineu-ai-actdeepseek-huaweiRead - Essays··7 min read
Hannover Messe 2026 delivered an industrial AI arms race · copilot versus agent
The fork between copilot and agent is the right framing for the next two years of industrial AI. The technology is real. The governance architecture to match it is not yet built.
industrial-aiagentic-manufacturingdata-governancehannover-messe-2026Read - Essays··8 min read
Erlangen, Spartanburg, and the Quiet Half of Industrial AI
The cognitive layer of industrial AI (copilots, agentic optimisation, the operating-system metaphor) is real and mostly in pilot. The physical layer of vision, manipulation and motion is the part actually booking cycle time on the factory floor. That asymmetry is the story.
industrial-aipilot-to-productionembedded-visionhumanoid-roboticsRead - Essays··7 min read
The Agentic AI Gap: SR 11-7 Is Dead, the EU AI Act Is Late, and Banks Are Shipping Agents Anyway
Three jurisdictions, zero frameworks designed for the agents already in production. The governance gap between SR 26-2's carve-out, the EU's sixteen-month delay, and the UK's 'further work' is where the first enforcement action will land.
agentic-aimodel-risk-managementeu-ai-actbanking-regulationRead - Essays··7 min read
Europe's AI Literacy Deadline Is Ten Weeks Away and Nobody Is Ready
The EU made AI literacy a legal duty eighteen months before the educational infrastructure it funded could plausibly deliver at scale. Article 4 enforcement begins in ten weeks. The sequencing mismatch is a compliance accident the Commission built with its own calendar.
eu-ai-actai-literacydigital-skills-gaparticle-4-enforcementRead - Essays··8 min read
The Two-Front Squeeze: AI's Energy Appetite Meets Its Own Regulation
The regulatory squeeze and the energy squeeze are the same squeeze. The industry has been running two separate playbooks as if they exist in different universes. They don't.
eu-ai-actdata-centre-energyinfrastructure-moratoriumsgrid-capacityRead - Essays··8 min read
Monitoring Was the Old Deal. Extraction Is the New One.
Monitoring measures a worker so a manager can manage them. Extraction copies a worker so the worker is no longer needed. Meta is running the second programme while calling it the first.
workplace-extractionmeta-layoffslabour-organisingai-agentsRead - Essays··8 min read
Geopatriation in Plain Sight: A Field Report from Brussels, Delhi, and Washington
Geopatriation, the localisation of AI workloads under sovereign pressure, is the dominant pattern in 2026. The compute sits under local governance; the silicon supply chain has not been localised at all. The truth is in the clauses.
ai-sovereigntyexport-controlseu-ai-actgeopatriationRead