Tag: iso-42001

EU AI Act Compliance Is a Pipeline, Not a PDF

Turning the EU AI Act and ISO 42001 into automated CI/CD gates, risk classification, and cryptographic provenance — not a last-minute audit binder.

Kovcheg's credit module drafts decisions on customer applications. Under the EU AI Act, this is not an "assistant" — it is a high-risk AI system. Creditworthiness assessment of individuals is explicitly named in Annex III, which moves the system into a different legal class: a mandatory risk management system, technical documentation, logs, human oversight, registration. In parallel, the text assistant generating replies to customers falls under Art. 50 — transparency for AI-generated content. One system, two different sets of obligations.

Continue reading “EU AI Act Compliance Is a Pipeline, Not a PDF”

Governance Operating Model & AIMS: How to Assemble a Control Plane That Survives Entropy

Technical controls degrade without an operating model. Here is how to assemble every plane into an AI Management System with policy-as-code and auto-generated evidence.

Imagine every control plane is built. PII is masked. RAG respects permissions. Guardrails block prompt injections. The audit trail writes to immutable storage. Budgets hold. Content is labeled. Quality is measured. The supply chain sits under an AIBOM. The agent sits behind a policy gate. Six months in, an ISO 42001 audit arrives — and there is nothing to prove, because ACL sync silently broke in March, the golden dataset hasn't been refreshed since launch, the kill-switch has never been tested, and the credit module formally has no owner. The technical controls went stale. Not from an attack. From nobody having been assigned to maintain or audit them.

Continue reading “Governance Operating Model & AIMS: How to Assemble a Control Plane That Survives Entropy”

Manifesto: AI Governance as a control plane, not a PDF policy

Governance that can’t be bypassed technically is not a document — it’s a control plane. Every model call physically passes through PII masking, access control, guardrails, and audit.

There are two ways to do AI governance. The first is to write a policy. A forty-page document: responsible AI principles, a committee, a role matrix, a requirement to "use AI ethically." It gets signed, filed in SharePoint, and revisited at the next audit. The second way is to build governance into the request path: every model call is physically unable to bypass PII masking, access control, guardrails, limits, and audit, because they stand in the way of the packet, not in the developer's head.

This is about the second way. The thesis is simple and blunt: governance that can't be bypassed technically is not a document — it's a control plane.

Continue reading “Manifesto: AI Governance as a control plane, not a PDF policy”