Category Archives: RAI & Compliance

Your AI Is Real-Time. Your Data Operating Model Isn’t (Yet).

Posted on by
Reply

Let’s be honest: many of us are trying to run 2025 AI ambitions on 2010 data habits. Nightly batches, opaque KPIs and committee-driven governance don’t survive contact with agents, RAG and copilots.

The more I work with transformation leads, the more I see two patterns emerge again and again:
1 Real-time velocity and semantically-rich data are no longer optional.
2 Federated production + centralized semantics is the only model that really scales.

This forces a redesign of the Data Operating Model (DOM):

  • Instead of “we have a data lake, we’re fine”, we need an event driven + streaming + semantics fabric.
  • Events, not just ETL.
  • A semantic layer where metrics, dimensions and policies live once and are reused everywhere.
  • RAG and agents consuming governed semantics and live APIs, not random tables.

And the “data mesh vs central model” wars? They’re a distraction. Data mesh delivers measurable outcomes.

What actually works is:

  • Federated production: domains own their data/real-time data products.
  • Centralized semantics: a small central team owns the shared language of the business, metrics and the policies around it.
  • Governance becomes computational: contracts, lineage and rules in code, not PDFs nobody reads.
  • Semantic layers are becoming the governance firewall, resolving data chaos. The semantic layer emerges as the critical “universal translator” between raw data and analytical/AI systems.
  • Data/AI/Analytics Architecture Convergence on Six Pillars: (1) Ingest/Stream, (2) Prepare/Transform, (3) Define/Model (semantic layer), (4) Store/Persist, (5) Integrate/Orchestrate, (6) Deliver/Share. The “Define/Model” stage—semantic layers + metadata management—is the control point for AI governance.

If I had to prioritise the next 12–18 months in a DOM, I’d push for three moves:
– Stand up 3–5 domain teams with clear P&L-linked data products.
– Create a semantic council with the authority to say “no” to broken KPIs and unsafe policies.
– Fund based on outcomes: latency, reliability, AI use-case adoption and reuse of shared semantics.

The hard question is “where do we start federating ownership without losing a single source of truth on meaning and controls”?

I’d love to learn from others here:
Where is your DOM actually stuck today — events, semantics, domain ownership, or governance?

From MLOps to LLMOps to AgentOps: Building the Bridge to Autonomy

Posted on by
Reply

We didn’t just upgrade models—we changed the discipline. What used to be “model lifecycle management” is now autonomy lifecycle management. And with that, enterprises are facing a truth most haven’t yet operationalized: we now live in three overlapping worlds—Traditional AI, GenAI, and Agentic AI—each with its own workflow logic, tooling, and governance.

In traditional MLOps, workflows were deterministic: data in, prediction out. Pipelines were clean, measurable, and managed through platforms like MLflow, Kubeflow, BentoML, or Evidently AI. We focused on reproducibility, accuracy, and drift detection—predictable systems built for static decisions.

Then came LLMOps, and the equation broke. We moved to unstructured data, prompts, RAG, and safety filters. Non-deterministic outputs meant no two runs were ever the same. Suddenly, we were tracking token costs, hallucination rates, latency SLOs, and human feedback loops in real time—using stacks like LangChain, LlamaIndex, PromptLayer, Weights & Biases, and Credo AI.

Now we’re entering AgentOps—the autonomy layer. Systems act, reason, and collaborate through orchestrators like LangGraph, CrewAI, or AutoGen. AWS is already positioning AgentCore (on Bedrock) as the enterprise runtime—agents with persistent memory, context, and real-time observability. But the architecture shift isn’t just technical; it’s organizational. The winning model is “federated”: specialized teams with unified observability across all three layers—AI, GenAI, and Agentic AI.

When I sit with exec teams, I see the same pattern: most can build great models, but few can run parallel operational capabilities at once. And that’s the new muscle—keeping deterministic, generative, and agentic systems aligned under one governance fabric.

What makes the difference isn’t the flashiest demo; it’s boring excellence—clear SLOs, version control, cost discipline, and behavioral guardrails. That’s how we turn agents into trusted co-workers, not expensive chaos engines.

So here’s the question I leave leaders with: If your org had to strengthen just one layer this quarter—MLOps predictability, LLMOps safety, or AgentOps autonomy—where would you start, and how ready is your team to run all three in parallel?

EU AI Act´s General-Purpose AI Models (GPAI) Rules Are Live: How to prove Compliance next months.

Posted on by
Reply

EU obligations for general-purpose AI kicked in on 2 Aug 2025. Models already on the market before 2 Aug 2024, must be fully compliant by 2 Aug 2027 – but boards won’t wait that long.

Over the past few weeks I’ve sat with product, legal, and model teams that felt “compliance-ready” … until we opened the evidence drawer. That’s where most programs stall. The good news: the playbook is clear now. GPAI Code of Practice (10 Jul 2025) gives a pragmatic path, and the Guidelines for GPAI Providers (31 Jul 2025) remove a lot of scope ambiguity. Voluntary? Yes. But it’s the fastest way to show your house is in order while standards mature.

Here’s how I’d tackle this —no drama, just discipline. First, align on who you are in the Act (provider vs. deployer). Then make one leader accountable per model and wire compliance into your release process.

My advice, Companies should:

  • Gap-assess every in-scope model against the Code. Do you have a copyright policy, a training-data summary, documented evals, and a working view of downstream disclosures? If any of those are fuzzy, you’re not ready.
  • Stand up model cards and incident logs; add release gates that block launch without evidence. Map risks to your cyber program using CSF 2.0 so Security and Audit can speak the same language.
  • Run an internal GPAI evidence audit. Publish an exec dashboard with: % of models with complete technical files and disclosures, incident MTTD/MTTR, and time-to-close regulator/customer info requests.

A quick reality check: big providers are splitting—some signalling they’ll sign the Code, others not. That’s strategy. Your advantage (especially if you’re an SME) is disciplined documentation that turns “we promise” into procurement-ready proof.

My rule of the thumb: if the CEO can’t see weekly movements on documentation completeness and incident handling, you are in pilot land – no matter how advanced the model sounds.

What would you put on a one-page dashboard to convince your CFO – and your largest EU customer – that your GPAI program in truly under control?

Agentic Operating Models: from Pilots to P&L

Posted on by
Reply

We’re past the demo phase. Boards are asking a harder question: how do human-plus-agent workflows show up in cash flow—this quarter? There is a clear answer: The winners don’t “add an agent”; they redesign the work. That means owners, SLAs, guardrails, and value tracking—weekly. Not glamorous, just effective.

Here’s the short playbook I’d bring to the next ExCo:

  • Make Agents products. Name a product owner, publish SLAs (latency, accuracy, human-override rate), and set chargeback so value—and cost—land in the P&L.
  • Design human+agent flow, end-to-end. Pilots fail for organizational reasons. Tie every pilot to a customer metric and a service level from day one.
  • Build guardrails you can audit. Map risks to NIST’s Cyber AI Profile; log decisions, provenance, and incidents. “Trust” that isn’t evidenced will stall at Legal.

Does it pay?  Signals are real but uneven. A European bank modernization program cut 35-70% cycle time with reusable “agent components.” In KYC/AML, agent “factories” show 200-2000% productivity potential when humans supervise at scale. Klarna’s AI assistant handles  ~1.3M monthly interactions (~800 FTEs) with CSAT parity. Yet BCG says only ~5% are truly at value-at-scale, and Gartner warns ~40% of agentic projects could be scrapped by 2027. Operating model discipline determines who wins.

If I had 90 days:

  • 30: Inventory top 5 agent candidates; assign owners; baseline SLAs and override rates.
  • 60: Stand up an Agent Review Board (CIO/CDO/GC/CISO); add release gates and rollback.
  • 90: Ship two agents to production; publish a value dashboard (savings, cycle time, SLA hit rate) and decide scale/retire.

A candid note on risk: labor anxiety and model drift will erase ROI if we skip change management and runtime oversight. Bring HR and the 2nd line in early, and rehearse incidents like you would a cyber tabletop.

If we can’t show weekly value, SLA adherence, and audit-ready evidence, we’re still in pilot land—no matter how advanced the model sounds.

What would make your CFO believe – tomorrow – that an agent belongs on the P&L?

Agentic Mesh or Just Another Buzzword? Cutting Through the Hype

Posted on by
Reply

Let’s be honest: most of us have sat through AI demos that looked impressive… and then quietly died in the pilot graveyard. Why? Because smarter models alone don’t create enterprise value. The real shift is moving from shiny pilots to system-level architectures—what McKinsey calls the Agentic Mesh.

I’ve seen this firsthand. When teams focus only on “better models,” they often miss the harder (and less glamorous) work: wiring agents together, defining guardrails, and making sure actions are auditable. That’s where scale either happens—or fails.

What are we learning as an industry?

  • Models matter, but architecture and process discipline matter more.
  • Standards like MCP and A2A are becoming the “USB-C of AI,” cutting down brittle integrations.
  • Governance isn’t optional anymore—ISO/IEC 42001, NIST AI RMF, and “human-on-the-loop” ops are quickly becoming the baseline.
  • We have to treat agents like digital colleagues: assign roles, permissions, even offboarding procedures.
  • And without proper observability—AgentOps, logs, kill-switches—autonomy can turn into automated chaos.

For executives, here’s what I’d do today if I were scaling this in your shoes:

  1. Name it. Create a platform team that owns the “mesh”—protocols, policy engines, memory hubs, observability.
  2. Start small, but measure big. Choose a few revenue- or cost-linked workflows, run shadow/canary pilots, and track hard KPIs.
  3. Bake in governance early. Build an agent registry, enforce least-privilege access, and red-team agents before production.
  4. Scale with discipline. Treat agent patterns like products—documented, reusable, and measured.

Here’s my takeaway: the winners won’t be those with the smartest model, but those who can turn agents into an integrated, trusted system—a digital workforce that’s secure, observable, and genuinely valuable.

👉 What’s been your biggest blocker moving from pilots to scaled AI systems—technology, governance, or people?

Beyond Compliance: How Dora Is Reshaping Financial Resilience into Competitive Advantage

Posted on by
Reply

Four months into full applicability, the Digital Operational Resilience Act (DORA) is proving more complex than anticipated. Financial institutions are navigating a fast-evolving regulatory landscape shaped by fragmented supervisory readiness, expanding technical requirements, and increasing market expectations.

Key takeaways:
* DORA is not a one-off checklist—it’s a multi-phase transformation touching governance, third-party risk, cyber resilience, and operational continuity.
* Mapping critical processes and ICT dependencies is now foundational.
* Third-party risk management must go beyond tick-box audits—dynamic oversight and contract readiness with cloud providers are essential.
* Operational resilience testing—including Threat-Led Penetration Testing (TLPT)—requires new levels of maturity and coordination.
* Compliance must shift from paper to practice—through automation, testing, and real-world response capabilities.

Strategic priorities for 2025–2026:
* Focus on business-critical ICT dependencies
* Strengthen third-party risk management
* Engage proactively with regulators
* Operationalise continuous compliance

Institutions that embed resilience—not just demonstrate compliance—will gain long-term advantage.

AI’s Black Box Nightmare: How EU IA Act Are Exposing the Dark Side of GenAI and LLM architectures

Posted on by
Reply

With the EU AI Act entering into force, two of the most 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭𝐬 for high-risk and general-purpose AI systems (GPAI) are 𝐄𝐱𝐩𝐥𝐚𝐢𝐧𝐚𝐛𝐢𝐥𝐢𝐭𝐲 and 𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬. But current GenAI and LLM architectures are fundamentally at odds with these goals.
𝐀.- 𝐄𝐱𝐩𝐥𝐚𝐢𝐧𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐛𝐚𝐫𝐫𝐢𝐞𝐫𝐬:
* 𝐎𝐩𝐚𝐪𝐮𝐞 𝐀𝐫𝐜𝐡𝐢𝐭𝐞𝐜𝐭𝐮𝐫𝐞𝐬: LLMs like GPT or LLaMA operate as high-dimensional black boxes—tracing a specific output to an input is non-trivial.
* 𝐏𝐨𝐬𝐭-𝐡𝐨𝐜 𝐈𝐧𝐭𝐞𝐫𝐩𝐫𝐞𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐋𝐢𝐦𝐢𝐭𝐬: Tools like SHAP or LIME offer correlation, not causality—often falling short of legal standards.
* 𝐏𝐫𝐨𝐦𝐩𝐭 𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐢𝐭𝐲: Minor prompt tweaks yield different outputs, destabilizing reproducibility.
* 𝐄𝐦𝐞𝐫𝐠𝐞𝐧𝐭 𝐁𝐞𝐡𝐚𝐯𝐢𝐨𝐫𝐬: Unintended behaviors appear as models scale, making explanation and debugging unpredictable.
𝐁.- 𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬 𝐁𝐚𝐫𝐫𝐢𝐞𝐫𝐬:
* 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠 𝐁𝐢𝐚𝐬: Models absorb societal bias from uncurated internet-scale data, amplifying discrimination risks.
* 𝐋𝐚𝐜𝐤 𝐨𝐟 𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐞 𝐀𝐭𝐭𝐫𝐢𝐛𝐮𝐭𝐞 𝐃𝐚𝐭𝐚: Limits proper disparate impact analysis and subgroup auditing.
* 𝐍𝐨 𝐆𝐫𝐨𝐮𝐧𝐝 𝐓𝐫𝐮𝐭𝐡 𝐟𝐨𝐫 𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬: Open-ended outputs make “fairness” hard to define, let alone measure.
* 𝐁𝐢𝐚𝐬 𝐄𝐯𝐨𝐥𝐯𝐞𝐬: AI agents adapt post-deployment—biases can emerge over time, challenging longitudinal accountability.
𝐂.- 𝐂𝐫𝐨𝐬𝐬-𝐂𝐮𝐭𝐭𝐢𝐧𝐠 𝐃𝐢𝐥𝐞𝐦𝐦𝐚𝐬:
* Trade-offs exist between 𝐞𝐱𝐩𝐥𝐚𝐢𝐧𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐚𝐧𝐝 𝐟𝐚𝐢𝐫𝐧𝐞𝐬𝐬—enhancing one can reduce the other.
* No standard benchmarks = fragmented compliance pathways.
* Stochastic outputs break reproducibility and traceability.
𝐖𝐢𝐭𝐡 𝐤𝐞𝐲 𝐭𝐫𝐚𝐧𝐬𝐩𝐚𝐫𝐞𝐧𝐜𝐲 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭𝐬 𝐛𝐞𝐜𝐨𝐦𝐢𝐧𝐠 𝐦𝐚𝐧𝐝𝐚𝐭𝐨𝐫𝐲 𝐬𝐭𝐚𝐫𝐭𝐢𝐧𝐠 𝐢𝐧 𝐀𝐮𝐠𝐮𝐬𝐭 𝟐𝟎𝟐𝟓, we urgently need:
• New model designs with interpretability-by-default,
• Scalable bias mitigation techniques,
• Robust, standardized toolkits and benchmarks.
As we shift from research to regulation, engineering 𝐭𝐫𝐮𝐬𝐭𝐰𝐨𝐫𝐭𝐡𝐲 𝐀𝐈 isn’t just ethical—it’s mandatory.