Writing
When there is something worth saying.
I write from my learnings, not on a schedule: what a readiness assessment actually finds, what a security questionnaire actually tests, where the frameworks agree and where they only appear to, and what the regulations coming into force actually require of a company your size.
If a claim cannot be verified, it does not go in. If a piece turns out wrong, a correction lands on the original, date-stamped.
Published
AI time savings are being booked as permanent. The law says otherwise.
AI time savings are being written into headcount plans as permanent. New rules give people the right to a human instead, and someone has to staff it.
First pieces, landing this fall
The security questionnaire is the real AI regulator
Most companies meet AI regulation first as a customer's procurement checklist, not as a law. What the AI sections actually ask, and what a credible answer looks like.
ISO 42001 in plain terms
Thirty-eight controls, nine domains, and what each one means for a company that has never run a management system. Where certification is worth it and where alignment is enough.