Articles
An AI-drafted control profile describes your documents, not your controls An AI-drafted control profile is bounded by its source evidence. Distinguish policy, self-report, observations and test results, then review source mappings and evidence gaps before using the profile for an assurance decision. Only the questions where they disagree are deciding your model choice A paired model comparison needs more than two average scores. Record item-level disagreements, uncertainty and the smallest difference worth acting on, then assess whether the evaluation can resolve that decision. Review the recovery boundary of every agent action Review an agent’s permitted actions, their consequences and recovery paths. Reversibility gives the architecture review a concrete question about who can correct an effect and within what time. The architecture outlives the team that built it Design an AI service so a successor team can operate, evaluate and change it. Retain decision records, quality criteria and reproducible dependencies, then test the handover instead of assuming documentation is sufficient. Specify the documentation profile before assessing conformity A documentation standard helps buyers only when its scope and required evidence match the decision. NIST’s July 2026 draft separates base templates from profiles that buyers can make more demanding. Keep clinical purpose and confirmation in change control MHRA guidance distinguishes administrative ambient scribing from products with a medical intended purpose. Review changes to clinical recommendations, confirmation and promotional claims before extending the workflow. Audit the benchmark before procuring against it Annotation corrections changed agent rankings in two text-to-SQL benchmarks. Use public scores to inform a shortlist, then inspect the answer key and test candidates against cases the organisation can review. The ICO's agentic AI timetable moved. The design work remains. Future agentic AI guidance does not remove current design responsibilities. Define the processing purpose, permitted tool access and routes for people to challenge significant automated decisions, while tracking the ICO’s publication status. Check citation as well as publication of an AI Act standard Publication of a European standard and citation in the Official Journal are separate events. Check the applicable legal status and begin keeping the process records needed to assess a high-risk provider’s quality management system. Review transparency duties alongside the amended AI Act dates The 2026 amendments changed high-risk application dates without moving all transparency duties. Review Article 50 by system function, organisational role and applicable exceptions, alongside the intended-use classification. Not every AI system needs the same governance Match internal AI review to the consequences, scope and recovery paths of the use. Begin with consequence and reversibility, alongside legal classification and other material risks. Someone else's capital cycle is your renewal risk AI operating costs depend on supplier prices, capacity and the work a model must complete. Test the business case against plausible changes and price the options for switching before accepting the dependency.
Bring us the question
Something here already on your desk?
That is the conversation we are best at. Thirty minutes, a written summary, no obligation.