Insights
Notes for founders, teams and practitioners who want ideas they can use.
Thinking in public
Short, practical notes from the work: what holds up, what breaks and which questions make product and market decisions clearer.
AI & Emerging Technology
ISO/IEC 42001 tells you to assess the impact of your AI systems. ISO/IEC 42005 shows how. Its most useful idea is that the assessment is a living record, not a launch document.
AI & Emerging Technology
Most AI governance effort goes into the approval gate. The harder work is noticing when a live system starts behaving differently, and having someone with the authority to act.
AI & Emerging Technology
Once a model can call tools, hold memory and act for a user, the risk shifts from what it says to what it does. The OWASP agentic list is a useful map of where that goes wrong.
AI & Emerging Technology
AI security now has a European standard behind it. ETSI EN 304 223 builds on the UK's AI cyber security code and spreads requirements across design, development, deployment, maintenance and end of life.
AI & Emerging Technology
The UK government wants a professional market for independent AI assurance. Before you commission an assurance provider, it helps to know what they will need from you and what their findings can and cannot prove.
AI & Emerging Technology
While the high-risk rules moved, the EU transparency duties for chatbots, generative output and deepfakes started on 2 August 2026. A final Code of Practice now shows what good marking and labelling looks like.
AI & Emerging Technology
The Digital Omnibus on AI pushed stand-alone high-risk obligations to December 2027. Transparency duties did not move, and the work a high-risk system needs takes longer than the delay buys.
AI & Emerging Technology
A governance policy is not evidence that governance happened. Good AI governance evidence is specific, dated, owned and defensible under scrutiny, in the same way COSO-style internal control evidence is.
AI & Emerging Technology
Privacy law is one part of AI governance, not the whole of it. Intellectual property, discrimination, consumer protection and product liability all apply before a data protection notice does.
AI & Emerging Technology
An AI system that is 87% accurate sounds reassuring until you ask who is affected by the other 13%. Harm, fairness and oversight questions come before the accuracy number does.
AI & Emerging Technology
The Data (Use and Access) Act 2025 creates a more permissive framework for solely automated significant decisions under UK GDPR, provided the right safeguards are in place. That is a change worth understanding, not a licence to skip human review.
AI & Emerging Technology
Not being based in the EU does not make the EU AI Act irrelevant. Its risk tiers and phased deadlines, including 2 December 2027 and 2 August 2028 for high-risk systems, shape a global AI law landscape that UK organisations still need to read.
AI & Emerging Technology
ISO/IEC 42001 is a management system standard, not a checklist. It asks an organisation to run AI governance as a repeatable system, the same way ISO 9001 and ISO 27001 do for quality and security.
AI & Emerging Technology
NIST AI RMF is a voluntary framework, not a law, but its four functions give a practical structure for AI risk management that survives contact with a real system.
AI & Emerging Technology
A risk review built for a simple chatbot does not cover a retrieval-augmented system, and it does not cover an AI agent that can take actions on its own. Each needs controls suited to what it can actually do.
Training & Education
Before you can govern AI, you need to understand what it actually is. A look at how Week 1 of the AI Governance, Risk & Compliance Practitioner programme builds that foundation, in plain language, using a recruitment-screening case study.
AI & Emerging Technology
The interesting question was never just whether an agent could complete a task. It's what it's allowed to do without asking first.
Product Strategy
A growing share of product discovery happens inside a conversation with an AI system before it happens on a search results page.
AI & Emerging Technology
A convincing demo and a reliable product can look identical for the first five minutes. The readiness gap is where most launches go wrong.
Product Delivery
Coding agents remove the busywork of implementation. They don't remove the decision about what deserves to be built next.
Product Strategy
When a prototype takes an afternoon instead of a month, it's tempting to skip straight from idea to prompt to deploy. That's where the real cost hides.
AI & Emerging Technology
AI makes it easy to ship code on trust rather than understanding. Here's the line between a useful shortcut and a risk with no name.
AI & Emerging Technology
Autonomous AI features fail for product reasons long before they fail for technical ones. Here's what needs ownership before the agent ships.
Product Strategy
Defensibility rarely comes from what a product does. It comes from what people have started doing because of it.
Product Strategy
Teams treat a narrow audience as something to grow out of. Often it's the thing that makes growth possible at all.
Product Delivery
MVP stopped meaning minimum a while ago. It's worth asking what your team means by it before the next release.
Training & Education
AI tools are making execution faster. They're not making the underlying decisions any easier, and that gap is starting to show.
Start a conversation
Useful first calls usually start with one unclear decision, a deadline and a team that needs a practical next move.
Tell us about it