Articles
Where your training data came from is now a balance sheet question Courts have begun separating the act of training from the act of acquiring the material, and the money has landed on acquisition. That distinction moves the diligence question from what a model does to where its inputs were obtained. Establish the statistical baseline before you buy a GPU A dull regression, run first, is the cheapest insurance policy in applied machine learning. It either tells you the expensive model is unnecessary, or it gives you the only number that can prove the expensive model was worth buying. The index moved to agents. Your procurement questions have not. The most widely cited composite measure of model capability now weights agentic task completion above everything else. That is a reasonable reflection of where the field went, and it makes a leaderboard position an even weaker answer to a buyer's question. Who is the provider? The question that decides your obligations Most organisations describe themselves as users of AI systems and assume the heavy obligations sit with whoever built the model. Several ordinary engineering decisions move that line, and none of them looks like a legal decision when it is made. Two governance blocs, one supplier list The World Artificial Intelligence Cooperation Organization, founded in Shanghai in July 2026, joins a field already holding the EU regime, the US approach and a set of national rules. For an enterprise the consequence is not geopolitical — deployment location has become a governance attribute. The ICO code of practice arrives as a duty, not a suggestion A statutory code carries weight that guidance does not — a regulator must take it into account and a court may. The instrument requiring one on AI and automated decision-making is already in force, and the position it will encode is already published. Reporting a serious AI incident starts long before the incident The AI Act's incident duty runs on a clock measured in days, and an organisation that begins assembling the facts when the clock starts will not meet it. What makes the deadline achievable is decided at design time. Sovereign inference is a control question, not a map question European buyers have started asking where inference runs and receiving an answer about which region a service is deployed in. Those are different questions, and the gap between them is where most residency commitments quietly fail. Five decisions, not two: how an assessment should end An assessment whose only possible conclusions are "approved" and "not approved" is not an assessment. It is an approval process with a report attached, and everyone in the room knows which answer is expected. NIST is writing the questionnaire. Read it before it arrives. The control overlays NIST is developing for AI systems will become the shape of enterprise security due diligence, because they map onto controls large buyers already run. Their drafts are public, and the categories they use are the useful part now. The questions to ask an AI supplier before you sign Most AI supplier due diligence asks about security and certification and stops. The questions that decide whether a system can be operated, evidenced and left are commercial ones, and they are cheap to ask before a contract and impossible afterwards. Your data records a process, not the world Historical enterprise data is a record of what an organisation decided, who it decided about, and what it happened to write down. A model trained on it learns the process — including the parts nobody would defend if they were written as a rule.
Bring us the question
Something here already on your desk?
That is the conversation we are best at. Thirty minutes, a written summary, no obligation.