BLOG

Enterprise architecture was built for information technology. Its domains cover business, data, applications and technology. Its tools describe how data is stored, moved and turned into information. That work remains essential. Yet AI operates further up the DIKIW model, where knowledge and intelligence live, and our architecture has no place for them. I call this next layer Intelligence Technology (I²T). DIKIW Model Applied to EA Applied to enterprise architecture, the DIKIW

In August 2017 I wrote a short post called Where to Make Compliance Improvements. It was one of the first things I published on my site. Nine years later I still point people to it. The core ideas have not changed. They have only become more important. The post made a simple claim. Programs, systems, and processes are different things. Each does a different job. If you confuse them, you will make improvements in the wrong place and wonder why outcomes do not change. Three Lev

Every organization is regulated. The question worth asking this Sunday is by whom. Most organizations would answer by naming an external body. A safety regulator. A privacy commissioner. A certification body that audits their management system. These bodies impose obligations and specify the instruments they will audit against. They are real regulators, and their oversight matters. They are also limited. An external regulator touches the organization only where its instrument

For the last few years, the question most people have asked about AI is whether it works. Does it give accurate answers? Does it save time? Does it deliver a return on investment? These are reasonable questions. They are also incomplete. There is a deeper question that deserves our attention. How do organizations that adopt AI remain viable? I have been reflecting on this question while revisiting an article I wrote on Cybernetic Control. That article was written for risk an

As organizations plan for 2027, many are deciding what work AI agents will take on next year. Successful businesses take ownership of their obligations and make commitments to meet them. These commitments are promises that must be kept. That is the lens worth bringing to AI: how can AI agents help us keep the promises we have made? Obligations and promises Over the last year in our Elevate Compliance Huddles, we have walked through the Operationalized Obligation model, which

When Prediction Becomes the Plan AI agents are being built to act on the predictions of AI models. That should give us pause. The belief behind this is simple. The model predicts the future, and the agent acts on that prediction as if it were reality. When an agent acts on a prediction, it helps make that prediction real. Its actions shape what happens next. The future arrives looking the way the model said it would. The model appears to have been right, and we trust it a lit

Digital Engineering as Strategy Organizations in high-risk industries are under pressure to adopt AI. They also carry commitments to regulators, workers, customers and the public. AI can help keep those commitments when it is engineered to do so. That requires being able to answer three questions at any time: - Are we on mission? - Are we operating between the lines? - Are we ahead of risk? Most organizations answer these after the fact, through audits, reports and reviews. A

When we talk about AI adoption, most people mean efficiency. Making existing processes faster. Swapping one process stack for another. Here's the thing. With what has been borrowed against AI, efficiency does not come close to settling the account. Because that is what this is. A debt. We have directed much of the world's capital into a single technology and away from everything else it could have funded. That capital was not free. It was borrowed against a promise. And capit

Audit Will Not Make AI Safe Ask almost anyone in compliance where the field ought to be heading and the answer comes back the same. Compliance should become proactive. It should anticipate risk rather than react to it. It should build the capability to meet obligations, not merely the paperwork to prove them. The obligations themselves have already moved. Regulation and standards have shifted toward risk-based and outcome-based designs, and they now ask organizations to conte

Investing in the Opportunity to Succeed Every business creates value under uncertainty. Some of that uncertainty can be reduced. It comes from what the organization does not yet know. About its processes. Its risks. Its obligations. The conditions it works in. Learning reduces it. So does capability. This is uncertainty you buy down. Some of it cannot be reduced. Variation is part of real conditions, and no amount of learning removes it. This is uncertainty you contend with b

Forward Assurance for AI Systems Audit looks backward. It verifies that something was done. Forward assurance is confidence that a system will keep its promises in operation — and that confidence cannot be inspected in after the fact. It is engineered in, by design. The gap AI is adopted when it can be trusted with the work that matters. We trust a mission critical system because we trust the people who design and build it, and the discipline they follow. That is what has to

Governance is a form of regulation. Cybernetics is the study of regulation in machines and living systems. It gives us two rules that matter here. First, the regulator must model the system it regulates. This is the Conant-Ashby theorem. Every good regulator of a system must be a model of that system. Second, the regulator must hold at least as much variety as the system it controls. This is Ashby's Law of Requisite Variety. Only variety can absorb variety. A set of finite co

Elevate Compliance Huddle · Session 100 THE FUTURE OF LEAN COMPLIANCE Elevate Compliance Huddle · Session 100 Monday, September 14 · Noon ET · Live on Zoom In our last webinar we explored what the future of compliance might look like in the age of intelligence. Obligations moving from rules to outcomes. AI arriving in the value chain, in the products organisations make, in their suppliers' processes, and in the compliance function itself. The message was this: compliance

I have used the same Compliance Program Scorecard for ten years. No one has ever disagreed with their score. That tells me the scorecard is reliable at evaluating compliance. People see where their compliance stands and they recognize it. What the scorecard gives them is where and how to improve. The reason that matters more now is AI. It does not change what compliance is. It changes what it takes to produce it. Obligations do not disappear when work moves to machines. They

Most conversations about AI and compliance go one of two ways. Either they are about technology, which tools to buy and what to monitor with them. Or they are about regulations, which rules now apply and how to map controls to them. Both are worth having. Neither is the one I think we are missing. Buying the right tools and knowing the right rules will not be enough, because underneath both is a culture and capability problem that AI is exposing rather than creating. AI adopt

Structural governance asks: are we inside the line? Directional governance asks: are we going to make it? Nearly every governance instrument we have answers the first question. The risk register. The control matrix. The attestation. The RAG dashboard. The assurance map. Not one of them answers the second. A ship inside its shipping lane is not thereby on course. Four years ago I wrote about bounded-set and centred-set compliance. A bounded set is defined by a boundary and you