A clearer view of AI at work.

Practical guides on finding the AI in use, reviewing vendors, writing rules people follow and putting AI to work.

5 October 2026 · 11 min readWhere to start with AI in a mid-size companyStart with the work, not the tools. Map where your team's hours go, fix two or three workflows, and measure the result. A plan for mid-size companies.

Search articles

48 articles

30 September 2026 · 11 min readHow to measure AI ROI: start with hoursA simple way to measure AI ROI: time the work before, measure it the same way after, and let finance confirm. Why freed time is not saved money.22 September 2026 · 11 min readWhy AI pilots fail, and how to get one into productionMost AI pilots never reach daily work. Five reasons they stall, and a practical way to get one workflow live and measured in eight weeks.17 September 2026 · 10 min readWhich processes to automate with AI firstScore each workflow on hours, handovers, ease and risk. Start where the time goes and the risk is low. A worked example with numbers per workflow.11 September 2026 · 10 min readWhy Copilot licences don't change how you workMany companies pay for Copilot and see little change. Why licences alone don't change workflows, and how to find where Copilot should be used.8 September 2026 · 4 min readMonitoring AI between audits: what to watch and whyAn audit tells you what your AI looked like on one day. Continuous monitoring tells you what changed the next. The difference, and when each matters.7 September 2026 · 4 min readShadow AI statistics 2026: the numbers every security leader should knowHow widespread shadow AI is in 2026, what it costs and where the real gap is: the key statistics, with their sources.4 August 2026 · 5 min readYour company's biggest AI power user isn't in engineeringSecurity teams lock down the dev team's AI tools while the real exposure walks in through marketing, sales, legal and the C-suite. Here's why you're watching the wrong door, and what to do about it.22 June 2026 · 4 min readHow to write an AI acceptable use policy your team will actually followAn AI acceptable use policy beats a ban every time. What to include, the full two-page structure, and the mistake that makes most of them fail.22 June 2026 · 4 min readAI and GDPR: where the two regimes overlap for European companiesAI and GDPR overlap the moment a tool touches personal data, and passing one regime does not mean passing the other. Here is how the two align.22 June 2026 · 4 min readHow to build an approved AI tools list that speeds adoption upAn approved AI tools list, or allowlist, manages risk and speeds adoption at once. How to build one and keep it from going stale, step by step.22 June 2026 · 4 min readNIST AI Risk Management Framework explained, and how it fits the EU AI ActNIST AI RMF is the voluntary framework many firms use to govern AI risk. Its four core functions, and how it fits with the EU AI Act, explained.22 June 2026 · 4 min readWhat is ISO 42001? The AI management system standard, explainedISO 42001 is the first international standard for an AI management system. What it covers, how it differs from ISO 27001, and why it matters now.16 June 2026 · 3 min readFrom 30-day compliance reviews to same-day AI approvalYour AI approval takes thirty days. Some competitors take a day. Here is how to turn compliance review from a bottleneck into a fast lane.16 June 2026 · 5 min readAI data leakage: the one paste that leaves your company exposedEvery day, employees paste source code, customer records, and contracts into public AI tools. Here is where that data goes, and how to stop it.16 June 2026 · 3 min readAI governance is a people problem, not just a policy problemYou can write the perfect AI policy and still fail the next audit. AI governance does not break on missing rules. It breaks on human behaviour.16 June 2026 · 4 min readAI voice cloning and executive impersonation: the scam your controls won't catchYour CFO calls asking for an urgent payment, in her exact voice. It is not her. Here is how AI voice cloning operates, and how to stop it cold.16 June 2026 · 3 min readHow CISOs and CTOs can align on AI adoptionThe CISO wants control. The CTO wants speed. Treat that as a fight, and AI adoption stalls. Here is how the two roles can actually align on it.16 June 2026 · 4 min readHow to discover every AI tool in your organisation, including the hidden onesAsk your teams which AI tools they use and the list comes back incomplete. Here is how to discover every tool, including the tools people hide.16 June 2026 · 3 min readHow to build a tech stack that scales without breaking complianceA tech stack that scales can still break the moment compliance catches up. Here is how you build one that grows without that painful reckoning.16 June 2026 · 4 min readThe AI tools your employees use without approval, and why they hide themYour employees use AI tools you have not approved. Not recklessness, just Tuesday. Here is what they reach for, and why they will not tell you.16 June 2026 · 4 min readWhy banning AI tools backfires, and what to do insteadBan an AI tool and people do not stop using it. They just hide it. Here is why blanket bans increase your risk, and what beats them every time.16 June 2026 · 3 min readWhy fast-growing companies take AI compliance seriously earlyThe companies moving fastest on AI are not the ones ignoring compliance. They are the ones who built it in early. Here is exactly why, and how.15 June 2026 · 4 min readContinuous compliance vs periodic audits: why the model is changingAnnual audits were built for systems that change slowly. AI does not. Here is why compliance is shifting from yearly checks to live monitoring.15 June 2026 · 7 min readNIS2 compliance: what it means for your software and AI stackNIS2 is now in force and reaches further than most teams expect: into your software vendors, and the AI tools your people quietly layer on top.15 June 2026 · 4 min readHow to prepare your AI stack for a security auditA security audit now reaches into your AI stack, and most teams cannot prove what is running or who approved it. Here is how to prepare.15 June 2026 · 4 min readShadow AI and the EU AI Act: why unmanaged AI is a compliance risk nowShadow AI is in scope of the EU AI Act whether you approved it or not, and most of it is invisible. Here is why that is a live compliance risk.15 June 2026 · 4 min readSOC 2 and AI: what auditors are starting to askSOC 2 auditors now ask about AI: how it touches customer data, who approved each AI tool, and how access is controlled. Here is what they want.15 June 2026 · 4 min readAI vendor risk: subprocessors, data hosting and certificationsYour AI vendors are part of your risk surface: their subprocessors, their data hosting, what they are certified for. Here's how to assess each.5 June 2026 · 5 min readArticle 50 transparency obligations: what changed on 2 August 2026Since 2 August 2026 the EU AI Act requires you to tell people when they are dealing with AI. Here is what Article 50 changed, and who it covers.5 June 2026 · 10 min readThe EU AI Act explained: scope, risk tiers, and the deadlines that actually applyThe EU AI Act applies in stages, not all at once. Here is who it covers, the four risk tiers, the deadlines that actually bind, and what to do.5 June 2026 · 5 min readLimited-risk vs high-risk: how to stop overspending on EU AI Act complianceMany teams over-classify their AI systems as high-risk and overpay under the EU AI Act. Here is how limited-risk and high-risk actually differ.5 June 2026 · 11 min readWhat is AI governance? (and why your audit trail is the missing piece)Most organisations write AI governance policies but skip the hard part: proving their AI systems actually did what the policy says, every time.4 June 2026 · 5 min readAI governance as a growth enabler: why slowing down is the real riskMost teams treat governance as the brake on AI adoption. The fastest-moving companies have learned it's the accelerator. Here's the real shift.1 June 2026 · 18 min readEU AI Act for US companies: what you're required to do and whenThe EU AI Act applies to US companies when AI reaches EU users. Learn what triggers compliance, which obligations apply, and where to start.30 May 2026 · 11 min readEU AI Act conformity assessment: what high-risk AI systems actually requireConformity assessment is the EU AI Act's proof of work for high-risk AI. Here's what to document, test, and sign off before deployment.30 May 2026 · 10 min readEU AI Act risk tiers explained: how to classify every AI system your organisation usesEU AI Act compliance depends on which risk tier your AI systems fall into. Get it wrong and you either over-invest or leave obligations uncovered.29 May 2026 · 12 min readAI governance vs AI ethics: why the distinction determines whether your AI programme worksMany organisations have AI ethics principles. Far fewer have governance that enforces them. Here's why that gap is a compliance risk.28 May 2026 · 3 min readHow companies lose control of AI before their first auditAI control is rarely lost in a breach. It slips away quietly through free tools, embedded features and unsanctioned use, until the first audit exposes the gap. Here is how it happens, and how to get ahead of it.26 May 2026 · 3 min readHow employees use AI tools without IT knowingEmployees don't file a ticket to start using AI; they just have a deadline. Here's how unsanctioned AI really spreads, why people don't tell you, and the move that beats banning it.24 May 2026 · 3 min readWhat happens when AI governance fails: real compliance risksAI governance rarely fails in a dramatic breach. It fails in the pause after a question you cannot answer. Here are the four real costs of that gap, and the single root they share.22 May 2026 · 9 min readShadow AI vs shadow IT: what changed and why it mattersShadow AI is not shadow IT with a different name. The data risks are worse, detection is harder, and the regulatory exposure is in a different category entirely.20 May 2026 · 10 min readAI governance framework for European companies: the 2026 guideHow European companies build an AI governance framework: the five pillars, how the EU AI Act, GDPR and NIS2 stack, and a phased roadmap.18 May 2026 · 3 min readHow to monitor AI usage across your companyMonitoring AI usage isn't about watching employees. It's about seeing which tools touch your data. Here's how to get real visibility, from discovery to continuous signals, without a surveillance programme.16 May 2026 · 12 min readHow to build an AI inventory: a step-by-step guideNo AI governance programme holds up without knowing what tools are in use. Here is how to build an AI inventory that stays accurate as adoption grows.14 May 2026 · 5 min readWhy compliance slows AI adoption, and how CTOs fix itEvery AI initiative your teams want to ship is sitting in an approval queue right now. This is how you clear it without cutting corners.12 May 2026 · 4 min readISO 42001 vs ISO 27001: what's the difference and do you need both?You're already managing ISO 27001. Your information security posture is documented, audited, and reasonably under control. Then someone in leadership asks: “Do we need ISO 42001 as well?”10 May 2026 · 8 min readWhat is a shadow IT discovery tool? Complete guide to detection and managementRight now, someone in your organization is logged into an unapproved AI tool, uploading a spreadsheet with customer data. They are not trying to break rules. They just need to work faster than your approved tools allow.8 May 2026 · 16 min readThe EU AI Act compliance checklist for European companiesAn eight-step EU AI Act compliance checklist for European companies: who it applies to, the risk tiers, the enforcement timeline and the penalties.