Reflections on ISO 42001 and audit training
I thought the auditor wanted to know the AI was safe and responsible. They wanted to know why it would stay that way.
Practical AI enablement and assurance
Why should the big end of town get all the benefits of AI?
Koncura helps startups, scale-ups, not-for-profits and social enterprises get real value from AI, use it safely, and demonstrate effective governance.
Principles
- Use AI where it helps - avoid it where it doesn't
- Minimise AI spend
- Minimise technology support
- Drive operational self-sufficiency
- Manage risk and keep it safe
Free PDFAI Governance at the EdgeTwenty-five AI governance scenarios with no easy answers. Each turns an abstract concept into a concrete situation, designed to skim quickly but ponder more deeply. Apply each one to your own real-world setting.Is your organisation ready?Articles
How to get complete, exact and repeatable results from AI on big-document work, and how to measure it. Read in order, starting with the first piece.
AI governance frameworks provide a strong basis for good governance. But they have to be used well to get any benefits in practice.
There is no checklist
Two organisations with identical AI controls. One is well governed and the other is a shambles. The difference is context.
Why AI governance can't just be about AI governance
AI brings its own risks, and it accelerates the ones you already have. The shape of ISO 42001 reflects that.
Small team, big impact
Much of the law scales with the size of the business. ISO 42001 and good governance scale with the impact of the AI.
Is it working?
You bought the licences and trained everyone. Governance is how you find out whether it's paying off, and where you could be doing better.
The documentation trap
AI can write you an excellent AI policy. The only problem is that it may describe a different organisation.
Describe the harm first
Good impact assessment doesn't jump to categories. A description of potential harm is what shapes the design, the controls and the monitoring.
Silent on cost
Conforming to ISO 42001 doesn't mean you're governing AI use well. Cost is where that shows most.
Justifying selection
If your system selects a person, the burden of explaining why is on you. Many industries have known this for decades.
The register is a lookup tool
Accreditation is usually treated as a badge. It's more useful as a way to check a supplier's claim.
Three weeks out
A readiness assessment previews what an audit would find, then helps you fix it at a pace that suits you.
BigDocs: rolling the dice on big documents
A lot of business still runs on big documents.
BigDocs: the benchmark
The patterns benchmarked on a hard case, contract review, against the one big prompt.
The Agentic Wordhouse: a dimensional model for your words
Most organisations keep their words the way their systems keep transactions: one document per occasion.
Structure first: documents are written for human eyes
A contract, a tender or an enterprise agreement is written for a person turning pages.
The instruction file: write the job down before it runs
Give an agent a big document and a library and ask it to do a thorough review.
Never retype: if the model can't retype it, it can't mistype it
The most natural request in the world is "give me the contract back with your changes".
Output built for oversight: put people where judgement is needed
A tidy redline is a strange thing to hand a reviewer.
Maintaining the Wordhouse: keeping it true as it grows
Every knowledge base starts with good intentions.
Build the tests in: borrowing confidence from engineering
Software teams stopped trusting "it looks right" a long time ago.
BigDocs: guiding principles
The BigDocs series is about one kind of work: big documents, often several at once, where the business transaction rests on getting the answer exactly right.