1 min read
AI SecurityISO/IEC 42001 makes AI governance auditable
ISO/IEC 42001 does not prescribe seven named documents; it requires controlled evidence that AI risks, responsibilities, and decisions are managed.
Blog & Vlog
Notes from the workshop
AI-assisted development, compliance software, security, and building products in the open. Written and video posts by Tim Crouch.
Editorial series
Choose a series
Follow a thread through the work, from product decisions and AI security to experiments and recorded talks.
Building CompylotAI
Product decisions, regulatory constraints, and human-in-the-loop review for compliance software that has to stand up to scrutiny.
Explore seriesAI Development, Honestly
How we use AI-assisted development in real work — including the limits, missed expectations, and failure modes.
Explore seriesEU Security & Compliance
Practical notes for regulated European teams navigating security, governance, and compliance requirements.
Explore seriesAI Security
Practical AI security: protecting systems, data, and people as AI becomes part of everyday operations.
Explore seriesLabs & NectarForge
Experiments, research notes, and launch updates from the ideas and products we are building in the open.
Explore seriesWatch & Learn
Recorded walkthroughs and talks, with written summaries for readers who would rather scan than press play.
Explore seriesAll posts
3 min readVideo
AI SecurityThe Risk-Based Blueprint inside the EU AI Act
Europe didn't ban AI. It ranked the harm — and the high-risk band is where most real systems actually live.
1 min read
AI SecuritySecure AI agents by their traits, not their labels
The Cloud Security Alliance's trait-based approach maps agent behavior and architectural choices to concrete security risks and controls.
4 min read
Labs & NectarForgeRebuilding globalsoftware.ai around the work
Why we tore down our own website and rebuilt it around what we actually do: services, products in progress, experiments, and a blog that brings our writing into one home.
4 min read
Building CompylotAIWhy AI-assisted compliance review still needs a human signature
AI can read a marketing document against MiFID II requirements faster than any human. It still shouldn't be the one who approves it. That's a design principle, not a limitation.
1 min read
AI SecurityThe OWASP AI Exchange connects AI threats to controls
The OWASP AI Exchange provides a lifecycle map for moving from AI governance and threat analysis to testing, operations, and residual-risk decisions.
1 min read
AI SecurityAdversarial machine learning needs a common language
NIST's attack taxonomy helps security teams connect adversary goals, access, lifecycle stages, and mitigations across predictive and generative AI.
1 min read
AI SecurityRed teaming generative AI is a lifecycle discipline
Microsoft's experience across 100 generative-AI products shows why testing must follow real system risks, not a generic attack checklist.
1 min read
AI SecurityThe OWASP LLM Top 10 is an application-security list
OWASP's 2025 list shows that securing an LLM application requires architecture, testing, and development controls around the model.
1 min read
EU Security & ComplianceThe EU AI Act turns AI governance into an operating obligation
The EU AI Act is not only a legal classification scheme; it requires organizations to connect AI risk, data governance, oversight, and evidence.
1 min read
AI SecurityManaging generative-AI risk with the NIST profile
NIST's Generative AI Profile extends the AI RMF with concrete actions for governance, data provenance, testing, and incident disclosure.
1 min read
AI SecurityAI security is governance in action
BaFin's central point is simple: AI security has to cover the whole decision process, not just the model.
1 min read
AI SecurityPutting Google's Secure AI Framework into practice
Google's SAIF implementation guide turns six security principles into an organizational process for designing, deploying, and operating AI safely.
1 min read
AI SecurityGoogle SAIF: six elements for secure AI
Google's one-page SAIF summary provides a useful executive test for whether AI security covers architecture, operations, and business risk.
2 min read
AI SecurityNIST AI RMF: govern, map, measure, and manage
The NIST AI RMF gives organizations a lifecycle structure for connecting AI governance, assets, architecture, measurement, and risk treatment.