SEARCH

Like all great Easter egg hunts, sometimes the most valuable treasures aren’t lost—they’re simply hidden where few think to look. Easter Egg Hidden in Plain Sight For eight years, our Proactive Certainty Program has contained a special Easter egg that many organizations have overlooked. This egg wasn’t tucked away in some remote corner or buried underground—it was displayed prominently, hiding in plain sight: the program’s ability to elevate GRC, along with many other compliance programs. “We already have a GRC framework,” compliance leaders would say, walking right past our not-so-secret Easter egg. “We don’t need another approach.” The subtext was obvious; they were too busy fighting fires, patching the next vulnerability, or closing gaps from their audits to realize a better way was in front of them. What they didn’t realize was that our Easter egg wasn’t a replacement for their GRC efforts—it was the key to unlocking their full potential. The Treasure Hidden in Plain Sight Organizations that discovered this hidden gem experienced a transformation. They watched as their governance structures evolved from merely existing to actively anticipating challenges. They witnessed their previously siloed and partially integrated systems become truly integrative, working in harmony rather than just coexisting. Most remarkably, they saw their risk management approach transform into certainty creation—ensuring obligations would be met even in unpredictable circumstances. The Easter egg was always there, if you took the time to look. It was hidden (not intentionally) from those who still looked through the lens of Procedural Compliance . However, some organizations would pause long enough to ask: “How exactly does your program differ from traditional GRC?” That question would uncover the egg’s location—the crucial understanding that GRC viewed through a procedural lens remains hidden, while GRC elevated through our Proactive Certainty Program reveals the key to success. The Easter Egg - Now Revealed The Lean Compliance Easter Egg The way our program elevates GRC is by transforming: From reactive Governance to proactive governance — We don’t just ensure governance structures exist; we help them learn to steer the organization to ensure mission success. From Risk management to certainty creation — Rather than just managing risks to avoid loss, we increase the probability of success, ensuring obligations will always be met even amidst uncertainty. From Integrated to truly integrative Compliance — Beyond simply mapping or connecting subsystems and data, we ensure they work together as one to achieve targeted compliance outcomes. Over the years, some organizations have discovered this treasure and have realized better outcomes from their GRC efforts. Are You Still Looking? Others continue to hunt, fill their baskets with more governance structures, management frameworks, risk assessments, compliance controls, and procedures—never realizing the real treasure isn’t just another egg but the special one to pull everything together–The Proactive Certainty Program. This program transforms your compliance to ensure you always stay on mission, between the lines, and ahead of risk. Our Easter egg isn’t new. It wasn’t lost. It’s been hiding in plain sight all along. It’s not for everyone, but it could be for you. Will your organization be the next to experience the Lean Compliance Easter Egg ? You can find out by filling in the Proactive Certainty Scorecard , and perhaps, you will discover the treasure within.

As organizations rush to adopt artificial intelligence, one common mistake is treating AI systems like just another IT solution. After all, both are software-based, require infrastructure, and are built by technical teams. But here’s the thing: AI systems behave fundamentally differently from traditional IT systems, and trying to design and manage them the same way can lead to failure, risk, and even regulatory trouble. To use AI responsibly and effectively, we need to engineer it—with discipline, oversight, and purpose-built practices. Here’s why. Traditional IT Systems: Predictable by Design Traditional IT systems are built using explicit rules and logic. Developers write code that tells the system exactly what to do in every scenario. For example, if a customer forgets their password, the system follows a defined process to reset it. There's no guesswork involved. These systems are: Deterministic : Given the same input, they always produce the same output. Transparent : The logic is visible in the code and can be easily audited. Testable : You can run tests to verify whether each function behaves correctly. Static : Once deployed, the system doesn’t change unless someone updates the code. This predictability makes traditional systems easier to govern. Compliance, security, and operational risk controls are well-established. AI Systems: Learning Machines with Unpredictable Behaviour AI systems—especially those based on machine learning (ML)—work differently. Instead of being programmed with rules, they are trained on data to find patterns and make decisions. Key characteristics of AI systems include: Probabilistic Behaviour:  The same input can produce different outputs, depending on the model’s training. Emergent Logic : The rules are not written by developers, but learned from data, which can make them hard to understand or explain. Continuous Change : Models may be retrained over time, either manually or automatically, as new data becomes available. Hidden Risks : Bias, drift, or performance degradation can emerge silently if not monitored. In short, AI systems are dynamic, opaque, and complex—which makes them harder to test, trust, and manage using traditional IT approaches. Why Engineering Matters for AI Because of these differences, AI systems need a new layer of discipline—AI engineering—to ensure they are safe, reliable, and aligned with business and societal goals. Here are some key concepts behind engineering AI systems: 1.  Robustness AI needs to perform reliably, even when it encounters data it hasn’t seen before. Engineering for robustness means testing models under various scenarios, stress conditions, and edge cases—not just relying on average accuracy. 2.  Explainability When an AI system makes a decision, stakeholders—whether users, regulators, or auditors—need to understand why. Explainability tools and techniques help uncover what’s driving the model’s decisions, which is essential for trust and accountability. 3.  Adaptive Regulation and Monitoring AI systems can degrade over time if the data they see starts to shift—a phenomenon known as model drift. Engineering for AI involves setting up real-time monitoring, alerting, and feedback loops to catch and respond to issues before they cause harm. 4.  Bias and Fairness Since AI learns from historical data, it can inherit and amplify existing biases. Engineering practices must include fairness checks, bias audits, and tools that help identify and mitigate discriminatory behavior. 5.  Life-cycle Management AI development doesn’t end at deployment. Engineering includes versioning models, tracking data changes, managing retraining pipelines, and ensuring models continue to meet performance and compliance requirements over time. Comparing the Two Approaches Here’s a simplified comparison: The Bottom Line AI systems hold enormous potential—but with that power comes greater complexity and risk. Unlike traditional IT systems, they: Learn instead of follow Adapt instead of stay static Predict instead of execute To manage this effectively, we need to engineer AI with rigor—just like we do with bridges, aircraft, or medical devices. This means combining the best of digital engineering with new practices in data and cognitive science, systems and model engineering, adaptive regulation, AI safety, and ethical design. It’s not enough to build AI systems that work. We need to build AI systems we can trust. This article was written by Raimund Laqua, Founder of Lean Compliance and Co-founder of ProfessionalEngineers.AI

Artificial intelligence feels no remorse when it discriminates, no concern when it violates privacy, and no accountability when its decisions harm human lives. This reality—that AI inherently lacks the capacity to care about its impacts—places a real and immediate burden of responsibility on the organizations that deploy these increasingly powerful systems. As AI technologies transform modern businesses the obligation of “duty of care" has surfaced as a critical priority for responsible deployment. This duty represents the specific obligations that fall to organizations that integrate AI into their operations, requiring them to act as the ethical and practical stewards for systems that cannot steward themselves. Because AI itself doesn't care, the responsibility falls squarely on those that lead their organizations to care enough to deploy it wisely. Organizations deploying AI face a critical choice today: Will you embrace your duty of care, or risk the consequences of unchecked artificial intelligence? The time for passive implementation is over. Take these essential steps now: ⚡️ Identify and evaluate AI obligations and commitments (regulatory, voluntary, and ethical) ⚡️ Implement effective management and technical programs to contend with uncertainty and risk ⚡️ Train leadership (business and technical) on AI ethics and responsible deployment principles ⚡️ Create clear accountability frameworks that connect technical teams with executive oversight Don't wait for regulations to force your hand or for AI failures to damage your reputation and harm those who trust you. Contact us today (pmo@leancompliance.ca) to schedule an AI Duty of Care Assessment and take the first step toward fulfilling your responsibility in the age of artificial intelligence that doesn't care—but you must.

A principle that is easily forgotten is that to change outcomes you need to change your capabilities. Michael Porter's value chain analysis helps to visualize the chain of capabilities needed to create business value. However, capabilities are needed for every endeavor that requires an outcome to be achieved and even more so to sustain and improve over time. The practice of this principle is essential for compliance to meet objectives associated with regulatory performance and outcome based obligations. It is also necessary to solve problems in pursuit of those goals. The following capabilities driven business canvas will help you focus your attention on what matters most when improving outcomes. Capabilities Driven Business Canvas This canvas is available in a PowerPoint format along with other templates, workshops, and resources by becoming a Lean Compliance Member.

Are you doing Value Stream Mapping (VSM) wrong? Are you doing Value Stream Mapping wrong? Value Stream Mapping is a powerful tool for eliminating waste in organizational processes. When implemented correctly, it creates leaner, more efficient operations by removing unnecessary activities. However, the challenge lies in distinguishing between what truly diminishes value and what actually creates or protects it. This critical blind spot leads to cutting elements that appear wasteful but are essential for mission success. ⚡️ How often have organizations eliminated safety stock as “waste,” only to discover it was their crucial buffer against supply chain uncertainties? ⚡️ How frequently have approval processes been streamlined for efficiency without considering their role in ensuring proper duty of care? ⚡️ How many times have compliance measures been reduced, inadvertently pushing operations to the edge of uncertainty and creating fragility instead of resilience? The key to effective process improvement isn’t just cutting—it’s strategic discernment. Yes, eliminate true waste, but equally important: ensure you’re adding what’s necessary for mission success - you need to do both. 🔸 Call to Action: Identify the Guardians of Your Commitments 🔸 Three practical steps to protect your promises while eliminating waste: ⚡️ Map commitment touch points - Identify each process step that directly supports meeting your regulatory obligations, policy requirements, or stated objectives. These are your value protection points. ⚡️ Distinguish promise-fulfilment from waste - Ask: "Does this step directly help us fulfill a specific commitment we've made?" If yes, it's not waste—it's essential. ⚡️ Create a commitment impact assessment - Before removing any step, evaluate: "Will this change hamper our ability to keep our promises to regulators, customers, or stakeholders?" Remember: True LEAN COMPLIANCE doesn't compromise your ability to meet obligations—it enhances it by removing only what doesn't support your commitments. Need help aligning your efficiency efforts with your commitment framework? Let's connect.

Is the collateral damage from AI worth it, and who should decide? When it comes to AI, we appear to be “hell-bent“ towards developing Artificial General Intelligence (AGI) so as to consume all available energy, conduct uncontrolled AI experiments in the wild at scale, and disrupt society without a hint of caution or duty of care. The decision of “Should We?” has always been the question. However, when asked, the conversation often turns to silence. Now, creating smart machines that can simulate intelligence is not the primary issue; it’s giving it agency to act in the real world without understanding the risk, that’s the real problem. Some might even call this foolishness. The agentic line should never have been crossed without adequate safeguards. And yet without understanding the risk, how will we know what is adequate? Nevertheless, here we are developing AI agents ready to be deployed in full force, for what purpose and at what cost? Technology is often considered as neutral, and this appears to be how we are treating AI, just like other IT applications, morally agnostic. Whether technology is agnostic or not, the question is, are we morally blind, or just wilfully ignorant? Do we really know what we are giving up to gain something we know very little about? To address some of this risk, organizations are adopting ISO 42001 certification as a possible shield against claims of negligence or wrongdoing, and AI insurance will no doubt be available soon. But perhaps, we would do better by learning from the medical community and treat AI as something that is both a help and a harm – not neutral. But more importantly, something that requires a measure of precaution, a duty of care, and professional engineering. If we did, we would keep AI in the lab until we studied it carefully. We would conduct controlled clinical trials to ensure that specific uses of AI actually create the intended benefits and minimize the harms, anticipated or otherwise. Time will tell if the decisions surrounding AI will prove to be reckless, foolish, or wise. However, what should not happen is for those who will gain the most to decide if the collateral damage is worth it. What are we sacrificing, what will we gain, and will it be worth the risk? Let’s face the future, but with our eyes open so we can count the cost. For organizations looking to implement AI systems responsibly, education is the crucial first step. Understanding how these standards apply to your specific context creates the foundation for successful implementation. That's why Lean Compliance is launching a new educational program to help organizations understand and take a standards-based approach to AI. From introductory webinars to comprehensive implementation workshops, we're committed to building your capacity for responsible and safe AI.

Risk-based thinking is a mindset (perception, personas, perspective) to proactively improve the certainty of achieving an outcome utilizing strategies that consider threats and opportunities. Risk-based Thinking This mindset integrates risk management into everyday decision-making rather than treating it as a separate process. This capability helps organizations succeed in the presence of uncertainty. By adopting this mindset, leaders proactively identify what might go wrong (threats) and what might create opportunities to improve their chance of success. This forward-looking approach aids in strategic planning, decision making, and execution. Risk-based thinking requires viewing situations from multiple angles – questioning assumptions, identifying potential gains, and balancing priorities. This helps teams avoid blind spots that could derail their objectives. When embedded in organizational culture, this approach creates a balanced framework for decision-making. It enables calculated risk-taking with appropriate safeguards, helping teams avoid both excessive caution and reckless advancement. Take Action Today Don't wait for a crisis to implement risk-based thinking in your organization. Begin by evaluating your current projects through this strategic lens. Identify three potential threats and three possible opportunities for each initiative. Then develop specific action plans to address these scenarios. Share this approach with your team and incorporate it into your regular planning processes. By making risk-based thinking a habit rather than an afterthought, you'll create competitive advantage in an increasingly uncertain business environment.

While Governance, Risk, and Compliance (GRC) in IT typically focuses on certified management systems like ISO 27001, SOC 2, and PCI DSS—with technology platforms designed for audit automation through integration—it often misses its true purpose. GRC should deliver targeted outcomes, not just certified systems. It needs to be operational, with all components working together to achieve compliance goals and objectives. Unfortunately, many organizations lack the know how to establish systems that are more than their parts. Lean Compliance addresses this gap by helping organizations achieve minimal viable compliance (MVC)—ensuring essential functions, behaviours, and interactions operate sufficiently together to generate targeted outcomes. Rather than focusing on integration alone, Lean Compliance emphasizes operability through a comprehensive model covering governance, programs, systems, and processes. Think of it as Operational GRC. GRC was always meant to deliver better safety, security, sustainability, privacy, quality, ethical, and regulatory outcomes—not just support audits and certifications. Our outcome-focused approach is what makes Lean Compliance different: we aim higher to ensure compliance delivers what you need for mission success.

According to Albert Einstein: Insanity is doing the same thing over and over again and expecting different results. And yet, that is exactly how some organizations approach compliance. Consistency and conformance is king and hoping for better outcomes is the primary article of faith. Any improvements that are made have more to do with form as prescribed r ather than function as intended . Under these articles of faith companies rarely know the effectiveness of their compliance which is usually not assured or measured. The phrase "blind faith" comes to mind.  Just follow the rules and everything will be just fine. Pain medication is available at the gift shop on your way out. This posture, and yes, it is mostly - posture - as common and prevailing as it may be, is fortunately changing. Slowly, yes; but changing nonetheless. But what is it changing to and how? A Better Way With Much Better Results In order to better protect public and environmental safety, stakeholder value, reputation, quality, and other value outcomes, a sea-change is happening to the risk and compliance landscape. Compliance obligations now have more to do with making progress towards vision zero targets such as: zero emissions, zero fatalities, zero harm, zero fines, zero violations, and so on, than meeting prescriptive requirements. The latter is still necessary but only as a part of an overall compliance framework. Why? because regulators, standards bodies, and stakeholders recognize that to address more complex and systemic risk organizations need more latitude in terms of the means by which risk is addressed. This is a huge paradigm shift for this who work in risk and compliance. Previous one-size-fits-all prescriptive approaches to prevent loss and mitigate harms are too expensive when aggregated across an industry or even an organization. But more importantly, they are ineffective to deal with the challenges that must now be faced. The bad news is that after decades under the tutelage of prescriptive regulations and industry standards making the necessary changes will not and have not been easy. Substituting audit regimes with performance and risk-based compliance services has been slow although there are signs that things are speeding up. At the same time continuing to use reactive, and silo-ed functions to meet obligations will not be enough and probably never was. Compliance must now be goal-oriented, proactive and integrated into overall governance and managerial accountability. Advancing outcomes is now the new king and risk-based approaches focused on continuous improvement over time is the new standard. Instead of hoping for better outcomes companies must now put in place measures to make certain that they are better – informed faith rather than blind faith. The good news is, this will make compliance more effective at protecting overall value and lighter weight in the process (think risk-based and lean). Compliance will be in a better position to contend with uncertainty and improve the probability that what we value is not lost and new value is advanced. If this only means preventing risk before they become a reality then this will be a huge win for everyone. Compliance will no longer be seen as a necessary evil and something to avoid but will be looked at as a necessary good and something to be good at. Of course, some will continue with the same approaches they have followed for years and hope for the best. But we know this leads to same outcomes that we have always had; passing audits but not advancing compliance outcomes or reducing risk.

Environment-First Future Those that have been following us will know that compliance needs to be more than just checking boxes and passing audits. This is true for all compliance domains including environmental obligations. In recent years I have written about how the compliance landscape has changed and that it needs to more like operations than simply a function that inspects and conducts audits. Compliance as a category of programs is more akin to quality which has control and assurance functions but also strives to build quality into the design of products, services and all functions of the organization. One does not need to see very far ahead to realize that this is exactly what is happening now in earnest for Environmental Compliance. Environmental compliance is moving beyond simply monitoring and reporting towards establishing programs and systems to reduce carbon footprint, emissions, waste, and other objectives all in increasing measure. Sustainability is now the top priority and net zero across every dimension is the driver for operational objectives. Instead of quality as job one or safety first programs, organizations now need to lead their risk & compliance programs with an Environment-First strategy. The Environment and ESG There are many reasons why we are now seeing a greater elevation of environmental initiatives within organizations. Some of these will include the heighten attention on climate change along with existing environmental protection regulations and initiatives. However, what seems to be the source of urgency and immediacy is the increase of ESG integration in the investment world. ESG is all over the news, financial reports and increasingly in shareholder reports. However, it does not have a consistent definition. In broad terms it is concerned with Environmental, Social, and Governance objectives applied to sustainability. Specifically, ESG investing is focused on scoring organizations on how well they are doing at being a good steward of the environment. In broad terms this is called value investing. However, investors are also interested in the impact organizations are making at improving the environment or reducing climate change and its effects. This is called impact investing. Currently ESG scoring is done by investors and ESG reporting is done by organizations with some regulation of common categories on which to report. However, for the most part, the categories and measurements used in scoring and how it is reported are far from being the same. Greater alignment is expected but there will always be gaps driven by differences in priorities across investors, organizations, and governments. Whether or not ESG helps to create greater returns for shareholders is debatable. In some cases, ESG investments may be more expensive and come with lower returns. However, what is starting to become clear is that the integration of ESG may have a greater impact on promoting environmental initiatives than what government regulations might enforce. In essence, the marketplace is engaging in a more significant way to drive environmental change which for many is a more effective and desirable approach. What we can say with certainty is that we are moving towards an Environment-First world which will affect investments, stakeholder expectations, and compliance obligations among many other things. Environmental programs will no longer be characterized by only monitoring and reporting. Instead, environmental programs will be defined by sustainability and the effective implementation of systems to progressively reach zero emissions, net zero carbon footprint, zero waste, zero environmental harm, and other environmental objectives. Are you ready for an Environment-First future? You can be. Lean Compliance has helped organizations establish an Environment-First program and can help you do the same. Subscribe to our newsletter so you don’t miss our future articles as we unpack what it means for an organization to be Environment-First and the impact this will have on compliance and the business as a whole.

In this article, I explore the key distinctions between framework-focused and operational compliance approaches, and how they relate to Minimal Viable Compliance (MVC). Minimal Viable Compliance A framework-focused approach to compliance emphasizes creating the structural architecture and formal elements of a compliance program. This includes developing policies, procedures, organizational charts, committee structures, and reporting mechanisms. While these elements are needed, organizations can sometimes become overly focused on documentation and form over function. They might invest heavily in creating comprehensive policy libraries, detailed process maps, and governance structures without sufficient attention to how these will operate in practice. It's akin to having a beautifully designed blueprint for a building without considering how people will actually live and work within it. In contrast, operational compliance focuses on the engineering and mechanics of how compliance actually works in practice. This approach prioritizes the systems, workflows, and daily activities that deliver on compliance obligations. It emphasizes creating practical, executable processes that enable the organization to consistently meet its regulatory requirements and stakeholder commitments. Rather than starting with the framework, operational compliance begins with the end goal followed by what promises need to be kept, what risks need to be handled, and identifying what operational capabilities need to be established. This might mean focusing on staff training, developing clear handoffs between departments, implementing monitoring systems, and establishing feedback and feed-forward loops to identify and address issues quickly along with steering the business towards targeted outcomes. The concept of Minimal Viable Compliance (MVC) bridges these two approaches by asking: what is the minimum set of framework elements and operational capabilities (functions, behaviours, & interactions) needed to effectively and continuously meet our compliance obligations? This does not mean building minimum or basic compliance. MVC recognizes that both structure and function are necessary, but seeks to optimize the balance between them. It avoids the trap of over-engineering either the framework or operations beyond what's needed for effective compliance. For example, rather than creating extensive policies for every conceivable scenario, MVC might focus on core principles and key controls while building strong operational processes around high-risk areas. This approach allows organizations to start with essential compliance elements and iteratively build upon them based on practical experience and changing needs, rather than trying to create a perfect compliance program from the outset. Driving Compliance to Higher Standards The key to compliance success lies in understanding that framework and operational compliance are not opposing forces but complementary elements that must work in harmony. The framework provides the necessary structure and shape, while operational compliance ensures that these translates into effective action – action that delivers on obligations. MVC helps organizations find the right balance by focusing on what's truly necessary to achieve compliance objectives that advance outcomes towards higher standards.

As artificial intelligence continues to advance, AI engineers face a practical challenge – how to build trustworthy systems when working with inherent uncertainty. This isn't merely a theoretical concern but a practical engineering problem that requires thoughtful solutions. CYNEFIN Uncertainty Map Understanding Uncertainty: The CYNEFIN Framework The CYNEFIN framework (pronounced "kuh-NEV-in") offers a useful approach for categorizing different types of uncertainty, which helps determine appropriate engineering responses: 1. Known-Knowns (Clear Domain) In this zone, we have high visibility of risks. Cause-effect relationships are clear, established practices work reliably, and outcomes are predictable. Standard engineering approaches are effective here. 2. Known-Unknowns (Complicated Domain) Here we have moderate visibility. While solutions aren't immediately obvious, we understand the questions we need to answer. Expert analysis can identify patterns and develop reliable practices for addressing challenges. 3. Unknown-Unknowns (Complex Domain) This zone presents poor visibility of risks. While we can't predict outcomes beforehand, retrospective analysis can help us understand what happened. We learn through observation and adaptation rather than pre-planning. 4. Unknowable (Chaotic Domain) This represents the deepest uncertainty – no visibility with unclear cause-effect relationships even after the fact. Traditional models struggle to provide explanations for what occurs in this domain. Current State of AI Uncertainty Current AI technologies, particularly advanced systems that use large language models, operate somewhere between zones 4 and 3 – between Unknowable and Unknown-Unknowns. This assessment isn't alarmist but simply acknowledges the current technical reality. These systems can produce different outputs from identical inputs, and their internal decision processes often resist straightforward explanation. This level of uncertainty raises practical questions about appropriate governance. What aspects of AI should receive attention: the technology itself, the models, the companies developing them, the organizations implementing them, or the engineers designing them? Whether formal regulation emerges or not, the engineering challenge remains clear. Finding Success Amid Uncertainty The path forward isn't about eliminating uncertainty – that's likely impossible with complex AI systems. Instead, we need practical approaches to find success while working within uncertain conditions: Embracing Adaptive Development Rather than attempting to plan for every contingency, successful AI engineering embraces iterative development with continuous learning. This approach acknowledges uncertainty as a given and builds systems that can adapt and improve through ongoing feedback. Implementing Practical Safeguards Even without complete predictability, we can implement effective safeguards. These include establishing operational boundaries, creating monitoring systems that detect unexpected behaviors, and building appropriate intervention mechanisms. Focusing on Observable Outcomes While internal processes may remain partially opaque, we can measure and evaluate system outputs against clear standards. This shifts the engineering focus from complete understanding to practical reliability in achieving intended outcomes. Dynamic Observation Rather Than Static Evidence While traditional engineering relies on gathering empirical evidence through systematic testing, AI systems present a unique challenge. Because these systems continuously learn, adapt, and evolve, yesterday's test results may not predict tomorrow's behavior. Rather than relying solely on static evidence, successful AI engineering requires ongoing observation and dynamic assessment frameworks that can evolve alongside the systems they monitor. This approach shifts from collecting fixed data points to establishing continuous monitoring processes that track how systems change over time. A Practical Path Forward The goal for AI engineering isn't to eliminate all uncertainty but to move systems from Zone 4 (Unknowable) to Zone 3 and (Unknown-Unknowns) toward Zone 2 (Known-Unknowns). This represents a shift from unmanageable to manageable risk. In practical terms, this means developing systems where: We can reasonably predict the boundaries of behavior, even if we can't predict specific outputs with perfect accuracy We understand enough about potential failure modes to implement effective controls We can observe and measure relevant aspects of system performance We can make evidence-based improvements based on real-world operation Learning to Succeed with Uncertainty Building trustworthy AI systems doesn't require perfect predictability. Many complex systems we rely on daily – from weather forecasting to traffic management – operate with a measure of uncertainty yet deliver reliable value. The engineering challenge is to develop practical methods that work effectively within the presence of uncertainty rather than being paralyzed by it. This includes: Developing better testing methodologies that identify potential issues without requiring exhaustive testing of all possibilities Creating monitoring systems that detect when AI behavior drifts outside acceptable parameters Building interfaces that clearly communicate system limitations and confidence levels to users Establishing feedback mechanisms that continuously improve system performance By approaching AI engineering with these practical considerations, we can build systems that deliver value despite inherent uncertainty. The measure of success isn't perfect predictability but rather consistent reliability in achieving beneficial outcomes while avoiding harmful ones. How does your organization approach uncertainty in AI systems? What practical methods have you found effective?