First, the regulator must model the system it regulates. This is the Conant-Ashby theorem. Every good regulator of a system must be a model of that system.

While this is necessary, it is based on an old model where meeting obligations (the act of compliance you start with an integrative, holistic, and proactive approach to meeting obligations, a different model

Promise Theory, the framework Mark Burgess developed to model autonomous commitment, sits at the heart His observation was that the command-and-control model of managing devices was itself producing vulnerabilities His response was to model a different design principle: devices that govern themselves from within by develops this as a formal proposal: **Promise Agents** — security equipment with embedded, fine-tuned AI models

Continuous Change : Models may be retrained over time, either manually or automatically, as new data Engineering for robustness means testing models under various scenarios, stress conditions, and edge Explainability tools and techniques help uncover what’s driving the model’s decisions, which is essential Engineering includes versioning models, tracking data changes, managing retraining pipelines, and ensuring models continue to meet performance and compliance requirements over time.

Rasumussen's model and others since represent a growing trend away from "root causes" or you might say Nancy's Leveson [2] provides an example of how this can be used to model safety control: Nancy Leveson - Hierarchical Model of Safety Control Framework Predictions Rasmussen's Risk Management Framework makes of pressure toward cost-effectiveness in an aggressive, competing environment Rasmussen's Migration Model - Transport Canada - Jim McMenemy, Safety Intelligence Project Rasmussen's migration model represents

and foundation models. However, organizations are developing their own specialized models for specific use cases. These custom models require their own risk assessment and safety measures tailored to their particular This means organizations cannot simply rely on foundation model providers to solve all safety problems If you're fine-tuning models, creating retrieval-augmented generation systems, or deploying AI agents

One is tearing down the model we’ve relied on for decades. Think about what that means for the platform model. The existing model has exhausted its goodwill. The SaaS model — the dominant business model in technology for the past two decades — starts to look Bespoke, AI-generated solutions invert that model.

Every problem becomes a reason for another model, another agent, another pipeline, multiplying without Most AI deployments have no equivalent: no clear conditions under which a model is retired, rolled back

assets and dependencies, classifying systems by impact and risk, then mapping controls to data quality, model Roles & Accountability Assign decision rights: executive sponsor, AI/Model Compliance lead, Engineering Strengthen what works, eliminate what doesn't, expand to next-priority systems This is the Lean Startup model risk and control effectiveness over time, using evidence from operations to update your governance model

This will look different across industry sectors, but each will have an operational model that must be following maps are helpful to identify where these places are: Total Value Chain Map Organizational Model The Operating Model Canvas book is a good place to start understanding operating models from which you

Regulatory Theorem posited by Conant and Ashby states that "Every Good Regulator of a System Must be a Model Examples of models that we are more familiar with include: a city map which is a model of the actual which is a model of an employee's roles and responsibilities, and so on. In more technical terms the model of the system and the regulator must be isomorphic. The theorem does not state how accurate the model needs to be or the technical characteristics.

Frameworks, control libraries, risk registers, maturity models, oversight committees — all of it operates This is the problem our Organizational Regulation Model was built to address: bringing regulation back Lean Compliance, helping organizations operationalize governance through the Organizational Regulation Model