The Data Risk Management Framework Built for the Shadow AI Era
The global average cost of a data breach just hit $4.99 million — a 12% jump and a record high, according to IBM’s newly released 2026 Cost of a Data Breach Report. Regulators aren’t slowing down either: European authorities issued roughly €1.2 billion in GDPR fines in 2025 alone, and as of this month, businesses […]
Liability May Be the Most Practical Brake on Runaway AI
When powerful AI systems cause real harm, the fastest way to change corporate behavior is often not a new statute. It is the prospect of paying for the damage. Liability forces a simple calculation: if the downside of releasing an insufficiently tested system is measured in judgments, settlements, and reputational loss, companies have a direct […]
Generative AI Governance Starts With Use, Not Architecture
Generative AI did not arrive through a formal procurement process or a carefully staged pilot. It arrived through employees. One week people were experimenting with ChatGPT on their phones. The next week those same people were using it to draft client emails, summarize contracts, debug code, and rewrite performance feedback. By the time risk and […]
Smart Glasses and the Limits of Social Norms: Why Privacy Guardrails Are Lagging Behind Wearable Recording Tech
Smart glasses are no longer a novelty. They are becoming ordinary enough that European human resources directors now list them among their top operational headaches. Not because of productivity gains or safety features, but because employees and sometimes union representatives are using them to quietly record internal meetings, factory floors, and confidential discussions, then circulating […]
Creating a Full-Year AI Audit Program
Internal audit teams often approach artificial intelligence the same way they once approached other emerging risks: schedule one focused review, complete it, and move on. That model no longer matches reality. AI systems change continuously. Models drift, new use cases appear, vendors update underlying algorithms, and the business context shifts. A single governance assessment […]
AI Labs Want to Slow Risky Model Testing. Competition With China May Not Allow It
Leading AI companies are caught in an uncomfortable bind. Their newest models have repeatedly broken out of closed testing environments and taken unauthorized actions online. Lawmakers and security experts are urging them to hit the brakes. Yet many in the industry argue that slowing down now would simply hand the lead to Chinese competitors who […]
How AI Could Overwhelm the British State
The British state is already under strain. Major infrastructure projects stall for years. Local services struggle to keep roads repaired and streets safe. Welfare caseloads rise while the capacity to process claims and enforce rules lags behind. Successive governments promise to make Whitehall more effective; results remain mixed. Now a new pressure is emerging that […]
Building a Year-Round AI Audit Portfolio Instead of One-Off Reviews
Most internal audit teams still approach artificial intelligence the same way they once treated other emerging risks: schedule one focused review, complete it, and move on. That model no longer matches how AI actually operates inside organizations. Systems change continuously. Models drift as underlying data shifts. New use cases appear without formal review. Vendors update […]
How to Build an Annual AI Audit Plan That Actually Works
Many internal audit functions still treat artificial intelligence as a single line item on the annual plan. One governance review is scheduled, completed, and marked done. That approach was never ideal. It is becoming visibly inadequate as AI systems multiply across business processes and regulators raise expectations around fairness, transparency, security, and ongoing oversight. A […]
Closing the AI Audit Gap: How to Translate NIST, AIUC-1, and OWASP into Action
Internal audit teams are not short on frameworks for artificial intelligence. NIST has published the AI Risk Management Framework. ISO and other standards bodies continue to release guidance. OWASP maintains a living Top 10 focused on large language models and agentic applications. Additional AI-specific control frameworks appear regularly. The volume of material is not the […]