Insights Governance
Governance
The oversight, audit and accountability structures that let an organisation trust an AI system enough to actually rely on it.
AI systems fail differently to traditional software. A crashed application is visible immediately, an AI system that has quietly drifted, hallucinated, or been manipulated through a poisoned input can keep producing confident, wrong output for weeks before anyone notices. Regulators in Singapore, the EU and elsewhere have converged on the same baseline expectation: an organisation must be able to demonstrate, not merely assert, that a human remains accountable for what an AI system does, with a traceable record and a tested way to intervene.
In the modern AI era, governance is a design decision made before the deployment rather than the paperwork that follows it, the same way a building's structural engineering is decided before the interior design. Every framework in this section, delegation tiers, risk scoring, vendor contract terms, oversight architecture, exists to answer one question a board, a regulator or a customer will eventually ask directly: who is accountable when this system is wrong, and how would you know before they told you.
-
ISO/IEC 42001 certifies a management system, not a model
Buyers increasingly ask whether an AI vendor is ISO/IEC 42001 certified. The question is reasonable, but the answer tells you less than most people assume, unless you know what a certificate actually covers.
-
The first hour of a crisis: what AI can do in a command centre, and what it must not
Crisis communications compresses time, and the first hour tends to set the course for the rest. AI can help a command centre see and draft faster. It cannot be the one that decides or speaks.
-
False positives in AML monitoring are a governance problem, not a tuning problem
Machine learning can cut alert noise sharply. A regulator will still ask why a given alert was closed or never raised, and the answer has to come from process, not from the model.
-
Your vendor can't explain the model either. That's the part people miss.
There's a version of the AI procurement conversation where documentation closes the transparency question. It doesn't, because most of what makes a modern model opaque was never the vendor's to hand over.
-
Parenting a superintelligent child: what values are we actually passing down?
Elon Musk called SpaceX and xAI staff the 'parents' of Grok. Two AI governance failures from the past eighteen months map almost exactly onto sixty years of parenting research, and only one of the four quadrants produces a system that keeps its values once nobody is watching.
-
Foundations of dependable agentic AI
Why engineering reliability into agentic systems depends on bounded task specifications and trajectory-level observability in production, not on how capable the underlying model is.
-
What your AI vendor contract is probably missing
Standard SaaS contract templates miss protections that matter specifically for AI vendor relationships, and the contract itself, not regulation, is currently an organisation's primary protection.
-
Where to begin: identifying tasks for quality, traceable, auditable AI agents
The TRACE framework that structures how to evaluate whether a task is right for autonomous agent deployment, and how much oversight it needs.
-
From human-in-the-loop to AI-on-the-loop: redesigning oversight architectures
How oversight structures need to change as AI systems take on more decision-making without a person approving every step, and why that shift is a design choice regulators already permit.