- Essays··8 min read
The Insurance That Does Not Yet Cover the Agent You Just Deployed
Commercial insurance is not lagging behind agentic AI—it is retreating from it. Standard Tech E&O policies now carry explicit AI exclusions, vendor contracts cap indemnity at 12 months fees, and SR 26-2 leaves agentic workflows outside traditional model risk management altogether. The gap is structural: institutions deploying agents in 2026 are accepting uninsured tail liability that existing products and contracts were never written to cover.
agentic-aiai-riskinsurancefinancial-servicesRead - Essays··8 min read
The Controls You Cannot Descope
ISO/IEC 42001 certification documents the system an auditor reviewed, not the one running in production today. Working through the standard's 38 controls, each one reveals the same structural gap: a management system written against a fixed architecture, for a product that shipped weekly.
iso-42001eu-ai-actai-governanceenterprise-aiRead - Essays··9 min read
The 73 AI Services Your Network Already Has
Enterprise networks now carry a median of 73 AI services that nobody formally approved — each below procurement thresholds, each handling sensitive data, none linked to a measurable outcome. EU AI Act obligations make deployer liability real for organisations that cannot account for their shadow stack. The argument here is for governance by inventory: a structured three-column sheet that decides which tools stay, which are cut, and what success looks like for the rest.
ai-governanceshadow-itenterprise-aifinopsRead