Writing that does the arguing my demos can't: what the standards and the law actually require, why the trust boundary is an architecture decision, and how to control agents in regulated operations.
ISO/IEC 42001 certifies a management system, never a model, and the EU AI Act's conformity route runs through harmonised standards that are not yet published. What the certificate carries, where it stops, and how an auditor actually tests an AI system.
Read the commentary →ISO 42001 and the EU AI Act, read precisely: the certificate disciplines the scaffolding, the harmonised standards are unfinished, and the durable asset is a replayable evidence trail.
A practitioner's mapping of agentic-AI controls to MAS FEAT, Veritas and model-risk guidance, set out as control objective, control, evidence, owner.
Governable AI is settled in the architecture, long before any policy document. The essay is about where to draw the line between what code computes and what a model may say.
The audit methodology, wired into a running workflow, with an IIA-style engagement over the top.
More as I publish. A companion video series on enterprise AI governance is in production.