Microsoft AI privacy rules for American classrooms stopped being a promise and became a signed contract on 7 September 2026, when Brad Smith and Randi Weingarten put their names on a 31-page Memorandum of Agreement. Two days later the American Federation of Teachers, the United Federation of Teachers and Microsoft announced it as the National […]
Responsible AI by design is the message a group of academic editors put into print this week, and it is aimed squarely at how data science teams currently work. The latest issue of the INFORMS Journal on Computing carries a special issue titled “Responsible AI and Data Science for Social Good”, and its co-editors argue […]
AI governance sets the rules, roles and decision rights for the AI you run. AI assurance is the evidence that those rules were followed and that the system behaves as claimed. The two words are used interchangeably, and the confusion costs money: policies nobody tests, or tests nobody asked for. This guide separates them cleanly with a side-by-side comparison table, the assurance techniques that actually produce evidence a buyer or regulator will accept, a RACI grid for who owns what, what the UK’s assurance-led approach and the EU AI Act each demand, realistic cost profiles, a 90-day plan to stand both up, and the mistakes that make an assurance programme worthless.
Most AI governance frameworks are written for banks. They assume a risk committee, a model validation team and a compliance officer with nothing else to do, so the 60-person business downloads the template and never uses it. This guide sets out the version that actually works at SME scale: six components, four risk tiers, five questions that decide the tier, four roles instead of a committee, controls configured inside the platforms you already license, and an evidence pack that answers an enterprise security questionnaire in an afternoon. It maps the whole thing onto ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act, sets out a 90-day rollout plan, states the real cost in person-days, and lists the mistakes that waste a year.
Brexit did not put UK companies outside the EU AI Act. The Regulation follows the market and the output, so a Manchester software firm selling into Dublin, a recruitment platform screening candidates in Berlin and a consultancy whose model scores French loan applications are all inside its reach. This guide turns Regulation (EU) 2024/1689 into a working checklist for UK teams: the dates that already bite, how to inventory your systems, how to work out whether you are a provider or a deployer, how to classify risk against the prohibited and high-risk tiers, the twelve technical obligations that attach to a high-risk system, what to demand from general-purpose model vendors, and the penalties waiting at the end.
Buying AI is not like buying a database. The product changes after you sign, your data may never come back, and legal, security and IT each see a different danger. This guide sets out a complete AI procurement checklist for all three teams, organised the way a purchase actually moves: intake and triage, three parallel reviews, evidence instead of assurances, scoring with three possible outcomes, and the contract clauses worth arguing over. It covers training rights, output ownership, retention limits, prompt injection, model provenance, cost ceilings and exit paths, plus how to keep the whole process fast enough that nobody bypasses it.
A practical operating model for autonomous AI agents: named ownership, four proportionate approval gates, risk tiering, monitoring thresholds that trigger re-approval, the five artefacts it runs on, and a 90-day build sequence.
AI system inventory work starts with an uncomfortable question nobody can answer: which AI tools are we actually using? This guide gives you the register that answers it — a field-by-field template, the five places shadow AI genuinely hides, seven discovery methods that surface tools nobody declared, a two-week sweep plan, a four-tier triage scale, and a clean mapping to ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
AI risk assessment is the step most organisations skip between “this tool looks useful” and “forty people now depend on it”. This guide gives you a two-page template you can fill in section by section, the seven risk categories worth scoring, a likelihood-impact-exposure scale that produces comparable numbers, the six steps of the exercise itself, the five controls that genuinely move a score, and a clean mapping to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
ISO 42001 certification costs a UK organisation roughly £12,000 to £180,000 in year one and takes six to fifteen months, and neither range means anything until you know what moves it. This guide splits the cost into the four budgets hiding behind one number, shows how certification bodies calculate audit days under ISO/IEC 42006, sets out a month-by-month timeline from gap analysis to certificate decision, explains the five things that reliably push the date, models the three-year cost that matters more than year one, and lists six levers that cut spend and elapsed time without weakening the certificate.
