AI Governance
The Data You Cannot Clean
Some enterprise data has no clean version to reach. The cleaning destroys the evidence — and the governance question changes from how clean to who owns it.
Writing
Essays on the governance of artificial intelligence.
Long-form analysis for board directors, executives, and the technology leaders who advise them. Updated regularly.
All writing
Cyber Governance
A Declaration Is Not a Warranty
What the EU Cyber Resilience Act changes for boards, run against Ivanti and FortiBleed: a reporting clock you never see, a declaration you cannot enforce, and the four asks a contract still has to carry.
AI Strategy
Freeze the Models Tomorrow. You'd Still Have Five Years of Work.
A coordinated AI slowdown changes little for most companies. My benchmark of two Qwen releases on a 2023 Mac shows why, plus four steps to take instead.
Technology Sovereignty
The Sovereignty Decade
European technology sovereignty stopped being a policy debate in June 2026, when a U.S. export-control directive took two frontier AI models dark worldwide for nineteen days. The five dependency layers, and a practitioner's roadmap to 2035.
AI Governance
AI Doesn't Need Perfect Data
The AI-agent readiness checklist describes deterministic automation, not AI. Why a bounded agent produces the data inventory no assessment can, and what has to be true before it runs.
AI Governance
Columns Not Layers
Seventy percent of an AI program is people. Most governance diagrams give them one box.
Cyber Governance
When the Security Product Becomes the Breach
The metrics that matter when the control is the exposure. Why the board dashboard of the last decade is finished, and the six numbers that replace it.
How Should Organizations Be Penalized for AI Failures That Could Have Been Prevented?
In 2019 I asked how organizations should be penalized for breaches they could have prevented. The same question now applies to AI failures, in a regulatory environment that finally has teeth.
AI Economics
Spend More, Win More: The Idea That Bankrupts Companies
More compute doesn't win the AI race. A dotcom veteran on the spending fallacy behind the AI bubble — and the one question boards should be asking.
I Predicted This Cybersecurity Reckoning in 2018. Here's What I'm Predicting for AI.
In 2018 I predicted the SEC would require public companies to disclose cyber risk. The rule landed in 2023 — five years later than I thought. Here's what the structural calls got right, the timing calls got wrong, and three predictions for AI governance in the next 24 months.
AI Strategy
You Are Not Buying a Model. You Are Underwriting a Bet.
A board-level map of the US, EU, and Chinese AI model vendors over the next 18 months: each bloc's strategic bet, and the governance exposure your enterprise inherits with each choice.
Cyber Risk in the SEC 10-K Era — and What's Coming for AI
A 2017 analysis of cyber risk in 10-K filings — TJX, Target, Home Depot — combined with what changed under the SEC's 2023 cyber disclosure rule and a forecast of AI-specific 10-K disclosure within the next 18-24 months.
AI Governance
The Unmonitored Supply Chain: AI's Next Governance Gap
Boards spent 20 years building software supply chain controls. AI just opened a new one — and it now has CVE numbers. Here's what's missing.
The Call No One Wants. The Call Is Now Coming for AI.
A 2016 essay on what it actually feels like to be on the receiving end of a breach notification call — reissued with a 2026 preface that maps the same dynamic onto the first generation of serious AI failures.
AI Security
Mythos doesn’t matter — yet. This is what matters.
Anthropic’s Mythos preview found ten thousand high- or critical-severity vulnerabilities in a month. None of them are how your enterprise gets breached this quarter. Here is what is.
What GDPR Taught Us About How the EU AI Act Will Actually Bite
Eight years on from GDPR, the EU AI Act is doing for AI what GDPR did for data. Here's what the second-order effects looked like then — and what to plan for now.
AI Governance
The Quiet Rehire
Why boards are approving AI layoffs against a 24% capability ceiling — and what governance discipline actually looks like before you cut.
Information Security Was Never Just IT's Job. AI Governance Won't Be Either.
A 2016 piece about why information security is the responsibility of everyone in the organization — reissued with a 2026 preface that applies the same argument, almost word for word, to AI governance.
AI Architecture
The Architecture Question
Why the future of AI won't be decided by the biggest model — and the five architectural decisions every enterprise is already making, whether they realize it or not.
Enterprise AI
The Integration Paradox
Why 87% of customer-facing leaders agree, only 5% deliver — and what the EU AI Act's high-risk deadline will reveal about who's prepared.
Editorial
On the Promise — and Risk — of AI
Why this site, and why now. A note on what to expect from the writing here, and the framework behind it.
Board Governance
What Every Board Needs to Know About AI
A practical guide for directors who want to lead, not just comply.