Less Guesswork.
Better Decisions.
Practical essays on what to build, what to check and when to change course.
Earlier governance essays are part of the archive, not our current service offer. Explore AI consulting and engineering for your team.
20 Essays
Keep three lines beside an AI-assisted decision
Three lines that make an AI-assisted decision easier to review.
The page I want beside every AI spend request
A small stop-or-scale record for leaders who need more than optimism.
The AI Approval Pack
Five short records for the decisions a policy cannot make for you.
The AI tool passed review. Then the workflow changed.
A practical second-look rule for model, region, data, logging, and fallback changes.
The Smallest Useful AI Control
A practical way to turn AI usage into evidence.
The AI Policy Is Not The Control
A practical way to turn AI usage into evidence.
The privacy-zone AI moat
A practical zone model for governed AI adoption.
The Fable 5 lesson for AI governance
Provider-risk controls for regulated AI teams.
Evidence-grade controls are boring on purpose
What regulated firms need to prove when the AI conversation leaves the boardroom.
Your AI policy is not the control
A field note on mapping shadow AI before the audit asks for proof.
Why Risk Committees Reject Autonomous AI (And What They Approve Instead)
What makes an AI stack pass a regulatory exam in 2026?
The EU AI Act Deadline Your APAC Firm Is Quietly Ignoring
August 2, 2026 is 60 days away. If your AI system output touches the EU, you are in scope. Most APAC regulated firms have not started.
How to Build an AI Compliance Gradient for Regulated Firms
TL;DR: Regulated firms in Asia Pacific cannot govern AI with a simple approved or unapproved list.
The AI Vendor DDQ: 3 Questions Your SaaS Security Form Misses
Most firms are auditing the wrong thing.
The AI Vendor DDQ: 3 Questions Your SaaS Security Form Misses
Most regulated firms evaluate AI vendors using standard SaaS security forms.
Why Your AI Policy Fails the HKMA Shadow AI Test (And How to Fix It)
The gap between your written controls and what regulators actually audit
The boring AI your risk committee can approve
I’ve been watching risk committee reviews at regulated firms in Hong Kong and Singapore this quarter, and the same pattern keeps playing out in nearly every one.
The Shadow AI Playbook
In the 1980s and 90s, employees brought personal laptops and dial-up modems inside corporate networks without going through IT.
The Shadow AI Playbook
In the 1980s and 90s, employees brought personal laptops and dial-up modems inside corporate networks without going through IT.
Article 26 asks for a name. You wrote a committee. Here's what to actually do:
Article 26 of the EU AI Act uses two words that break most compliance documentation.
Put The Idea To Work.
A workflow your team keeps chasing? Let’s look at it together.