Articles
Publish evidence that readers and retrieval systems can use Clear, accessible and well-sourced publishing gives retrieval systems usable material. Improve those inputs for readers and automated access, while recognising that they cannot guarantee selection or citation. Where your training data came from is now a balance sheet question Data acquisition, training and publication can raise different rights questions. Record corpus provenance and assess supplier continuity, contract protection and output use against the relevant jurisdiction and facts. Establish the statistical baseline before you buy a GPU Compare a proposed model with a simple method and the existing process before committing budget. A fair evaluation shows whether the extra capability earns its cost and which limits come from the data or workflow. Read the benchmark weights before procuring the model A composite model score reflects its selected tasks and weights. Use the Intelligence Index v4.1 as a worked example of why procurement still needs evaluation against the buyer’s workload, costs and failure conditions. Who is the provider? The question that decides your obligations Determine the organisation’s AI Act role from the system, intended use and changes it makes. Branding, substantial modification or a new high-risk purpose can require reassessment, with the applicable conditions checked by legal advisers. Two governance blocs, one supplier list International AI initiatives do not create one uniform rulebook. Record where a service operates, whom it serves and which obligations apply, then review supplier evidence and portability against that deployment. Prepare for the ICO code against current duties The ICO is required to prepare a statutory AI and automated decision-making code. Existing data-protection duties continue while it is developed. Assess live systems now and distinguish current obligations from anticipated guidance. Reporting a serious AI incident starts long before the incident Serious-incident reporting needs facts about the system, affected people and resulting action. Establish records, detection routes and accountable owners before an event, then assess the applicable duty and reporting deadline. Sovereign inference is a control question, not a map question An EU processing region answers only part of a sovereignty requirement. Specify operator jurisdiction, support access, retained records, change authority and continuity, then assess the arrangement against the workload’s actual needs. Five decisions, not two: how an assessment should end A risk assessment should support a recorded decision, with conditions, owners and remaining uncertainty. Five possible outcomes help distinguish acceptable use from work that needs controls, redesign or specialist review. Use NIST’s draft overlays to sharpen the AI security review NIST’s developing AI security overlays offer a use-case vocabulary for reviewing controls. Map the relevant assistant, predictive-model and agent exposures now, while keeping draft guidance separate from contractual or legal requirements. The questions to ask an AI supplier before you sign AI due diligence needs evidence, change and exit questions alongside security review. Agree responsibilities, usable records and transition conditions before accepting the service dependency.
Bring us the question
Something here already on your desk?
That is the conversation we are best at. Thirty minutes, a written summary, no obligation.