- Essays··8 min read
The Controls You Cannot Descope
ISO/IEC 42001 certification documents the system an auditor reviewed, not the one running in production today. Working through the standard's 38 controls, each one reveals the same structural gap: a management system written against a fixed architecture, for a product that shipped weekly.
iso-42001eu-ai-actai-governanceenterprise-aiRead - Essays··8 min read
The Certificate You Did Not List
Enterprise procurement teams are embedding ISO 42001 status into vendor questionnaires ahead of the EU AI Act's August 2026 enforcement milestone — and deals are stalling when that field comes back empty. The pattern mirrors how SOC 2 became a contract gate a decade ago, but the timeline is compressed to eighteen months rather than five years. Vendors without an auditable AI management system are not losing on price; they are failing the first screening before negotiation begins.
iso-42001ai-governanceeu-ai-actenterprise-procurementRead - Essays··7 min read
Three Clocks Ticking on the Same AI Quarter
Three deadlines are converging on the same AI quarter. One is set by treaty, one by physics, one by the next insurance renewal. Most boards are tracking the first, glancing at the second, and have never heard of the third.
eu-ai-actdata-centre-powerai-liability-insuranceai-governanceRead