316 free articles on AI governance and AI risk management: EU AI Act, NIST AI RMF, ISO 42001, incidents, deadlines and practical controls. New posts daily. Subscribe by RSS.
Attack research on large language models has moved from demos to real campaigns, and most AI risk programs still treat prompt injection as a theoretical problem.
Governance frameworks treat AI agents as single tools, but when agents pass state across organizational boundaries, accountability splinters into something no compliance checklist can audit.
Behind the news: the AI governance gaps it exposes, and how to close them.
The absence of overreliance stories in the AI incident record is not proof the risk is rare. It is evidence that governance teams are burying the failures that would expose their own training programs.
A former Twitch employee is suing Amazon, alleging they used her private data to train a generative AI model without her permission.
The ADMT Act's notice and opt-out requirements create a perverse incentive: opaque models are easier to claim are exempt than auditable ones.
Schools are now teaching students to spot chatbot errors, which is the same accountability gap that cost Air Canada in 2024 and that your support bot still has today.
Zero reported stories on environmental harm and robustness does not mean zero risk. It means the news is structurally blind to those failures.
What a recent fairness case reveals about AI risk management — the failure mode and the controls that contain it.
California's 2027 AI rules will push enterprises to hide internal failure reports, not improve them.
A family lost money to a deepfake impersonating an immigration attorney. The failure pattern is authorizing sensitive actions on one unverified channel.
Security researchers write about what is being exploited today. Governance teams write about what regulators will demand in 2027. The gap is not a lag, it is a misalignment.
A class action over recorded conversations highlights the gap between what AI transcription tools capture and what users actually consented to, and the same gap exists in your own systems.
Attackers are hiding instructions inside web pages, documents, and emails that AI agents read, and those hidden commands can make your system take actions it was never supposed to take.
The updated OWASP list highlights how LLM outputs that are not grounded in verified sources can lead to real-world harm, and what risk teams should do about it.
Canada's OSFI Guideline E-23 turns AI models into regulated models, but the specialized talent to validate them is scarce and about to get far more expensive.
A Michigan township warned residents about AI-generated robocalls impersonating officials and demanding property tax payments. The scam shows how cheap generative AI tools make impersonation fraud easy, and why governance teams need to treat synthetic media as a fraud vector, not just a content problem.
A drop in reported AI incidents looks like progress, but the data shows organizations are re-labeling failures as compliance issues to dodge liability.
The OWASP Top 10 for LLMs focused on vulnerabilities; the next wave of regulation and enforcement will focus on whether you can prove you managed the risk of AI outputs that are simply wrong.
Governance teams focus on privacy and fraud, but security teams track prompt crafting and evasion as the real threats.
A stolen API token let attackers hijack an AI assistant's identity, showing that identity controls, not just prompt filters, are the first line of defense.
The drop in reported governance incidents signals a shift to private legal channels ahead of enforceable deadlines.
The 2026 OWASP list shifts from prompt injection to agentic security, where the model's actions, not just its outputs, become the risk surface.
A security story worth a second look — and the AI governance moves it should prompt.