Articles
ISO/IEC 42001 is a management system, not a badge ISO/IEC 42001 asks an organisation to maintain an AI management system. Procurement assurance depends on that system continuing to operate as models, suppliers and use cases change, rather than on documents prepared for an audit. Build evaluation evidence before approving the system Fund and maintain evaluation evidence alongside the AI service. Representative cases, reviewed expectations and explicit access boundaries make supplier, model and workflow changes easier to assess. An automated judge is an instrument. Calibrate it or do not read it. An automated judge can produce consistent scores while giving biased comparisons. Validate it against human judgements on the intended task, test ordering effects and recheck the instrument when the rubric or model changes. Design the action boundary for prompt-injection failure Prompt injection can influence an AI system through untrusted input or retrieved content. Combine prevention and detection with permissions, approval and disclosure controls that constrain the consequences if an attack succeeds. The cheapest token is the one you did not send Evaluate lookup, prompt caching and answer reuse against the actual workload. Stable prompt structure can reduce processing cost, while answer caches need explicit access, freshness and invalidation rules. Design the review queue alongside the screening model Translate screening metrics into alert volumes and review work. At low prevalence, false positives can dominate the queue, so acceptance must include missed cases, review capacity and the consequences for people flagged. Shadow AI is a measurement problem before it is a policy problem Unsanctioned AI use needs a proportionate view of the tools, tasks and information involved. Use that evidence to provide workable approved routes, target controls and review whether the response changes behaviour. Choose the workflow around the planning decision Choose orchestration against the task’s planning needs, authority and cost. Fixed workflows, model-routed branches and adaptive agents offer different controls. Evaluate the additional flexibility before approving it. Verify payment authority beyond a familiar face The reported Arup fraud shows why familiar faces and voices cannot establish payment authority alone. Use independent verification and transaction-bound approval, and test the process against impersonation. What an inference architecture has to hold An inference design needs explicit choices about access, routing, context, serving and records. Assess those concerns against the workload so the service can be operated, evaluated and changed with known limits. Give inference cost an owner and a unit of work Inference spend depends on provider pricing, workload and architecture. Measure cost per accepted unit of work so model choice, context, retries and review effort can be assessed together. Set the authority boundary for customer-facing answers A customer assistant can make consequential statements about price, policy and entitlement. Define the authoritative sources, validation and human approval needed before those statements reach the customer.
Bring us the question
Something here already on your desk?
Bring the question, the systems involved and the decision you need to make. We will confirm whether a scoped engagement is appropriate.