BLOG

Organizations cannot keep up using Compliance 1 principles and practices. Today’s regulatory frameworks, standards, and technologies such as AI call for Compliance 2, a holistic, systems-based, and operational approach to compliance. This is what we have been working towards for the last 10 years, and it is needed now more than ever. To make more of that work available, I am releasing a selection of Lean Compliance webinar recordings to everyone at leancompliance.ca/webin

Many organizations are now standing up AI governance. Most are doing it the way compliance has always been done. They adopt ISO 42001 or prepare for the EU AI Act, write a policy, form a committee, inventory their AI, and build a register of controls. That work has its place. But if you want to keep AI within your governance where it is actually used, there are two big gaps to close. Consider how quality works. No one believes an ISO 9001 certificate produces quality. Quality

Sunday AI Reflections A couple of years ago I wrote about Iain McGilchrist's work on the divided brain and what it might mean for risk and compliance. I argued that organizations need whole brain thinking, bringing together the parts of the business that protect against loss with the parts that pursue new opportunities. I have been returning to McGilchrist's work as I watch how organizations are approaching AI. What I see concerns me more now than it did then. I believe the

Why governed records will not make AI safe Every commercial aircraft carries a flight data recorder. It is one of the most carefully governed records in any industry. Its design is certified, its contents are protected, and its chain of custody is controlled from the moment it is recovered. And yet, a flight recorder has never prevented a crash. That was never its purpose. The recorder helps us learn after something catastrophic has gone wrong. Keeping an aircraft safel

Some things are best described as the absence, or privation, of something good. Normalization of deviance, drift to failure, unsafe conditions, and unsafe acts all take their meaning from a positive prior. We first define what it means to be safe. Integrity is a measure of how well that state is maintained, and any loss of integrity is what we call “unsafe.” The Challenger accident shows how this works. The solid rocket booster joints were designed so that the O-rings would n

The Enterprise Digital Cognition Map For decades, enterprises have been climbing what we used to call the IT ladder. We started with data processing. We moved to information systems. Today we are building intelligence technology with AI. At each step, we named the technology after the highest rung it reached. Each name described what the technology processes. None described what it is for. I have been working on an updated map to address this. It combines three ideas: the DIK

Much of the current discussion on AI governance focuses on evaluating decisions at the point of execution. An agent proposes an action, and the action is checked to see whether it is admissible. In earlier posts I raised two problems with this approach. It does not account for acts of omission, and actions that are acceptable on their own can still be unsafe in aggregate. There is a third problem, and it concerns what the decision is being evaluated against. Positive Priors T

Enterprise architecture was built for information technology. Its domains cover business, data, applications and technology. Its tools describe how data is stored, moved and turned into information. That work remains essential. Yet AI operates further up the DIKIW model, where knowledge and intelligence live, and our architecture has no place for them. I call this next layer Intelligence Technology (I²T). DIKIW Model Applied to EA Applied to enterprise architecture, the DIKIW

In August 2017 I wrote a short post called Where to Make Compliance Improvements. It was one of the first things I published on my site. Nine years later I still point people to it. The core ideas have not changed. They have only become more important. The post made a simple claim. Programs, systems, and processes are different things. Each does a different job. If you confuse them, you will make improvements in the wrong place and wonder why outcomes do not change. Three Lev

Every organization is regulated. The question worth asking this Sunday is by whom. Most organizations would answer by naming an external body. A safety regulator. A privacy commissioner. A certification body that audits their management system. These bodies impose obligations and specify the instruments they will audit against. They are real regulators, and their oversight matters. They are also limited. An external regulator touches the organization only where its instrument

For the last few years, the question most people have asked about AI is whether it works. Does it give accurate answers? Does it save time? Does it deliver a return on investment? These are reasonable questions. They are also incomplete. There is a deeper question that deserves our attention. How do organizations that adopt AI remain viable? I have been reflecting on this question while revisiting an article I wrote on Cybernetic Control. That article was written for risk an

As organizations plan for 2027, many are deciding what work AI agents will take on next year. Successful businesses take ownership of their obligations and make commitments to meet them. These commitments are promises that must be kept. That is the lens worth bringing to AI: how can AI agents help us keep the promises we have made? Obligations and promises Over the last year in our Elevate Compliance Huddles, we have walked through the Operationalized Obligation model, which

When Prediction Becomes the Plan AI agents are being built to act on the predictions of AI models. That should give us pause. The belief behind this is simple. The model predicts the future, and the agent acts on that prediction as if it were reality. When an agent acts on a prediction, it helps make that prediction real. Its actions shape what happens next. The future arrives looking the way the model said it would. The model appears to have been right, and we trust it a lit

Digital Engineering as Strategy Organizations in high-risk industries are under pressure to adopt AI. They also carry commitments to regulators, workers, customers and the public. AI can help keep those commitments when it is engineered to do so. That requires being able to answer three questions at any time: - Are we on mission? - Are we operating between the lines? - Are we ahead of risk? Most organizations answer these after the fact, through audits, reports and reviews. A

When we talk about AI adoption, most people mean efficiency. Making existing processes faster. Swapping one process stack for another. Here's the thing. With what has been borrowed against AI, efficiency does not come close to settling the account. Because that is what this is. A debt. We have directed much of the world's capital into a single technology and away from everything else it could have funded. That capital was not free. It was borrowed against a promise. And capit

Audit Will Not Make AI Safe Ask almost anyone in compliance where the field ought to be heading and the answer comes back the same. Compliance should become proactive. It should anticipate risk rather than react to it. It should build the capability to meet obligations, not merely the paperwork to prove them. The obligations themselves have already moved. Regulation and standards have shifted toward risk-based and outcome-based designs, and they now ask organizations to conte