Audit functions face a dual challenge: using AI to improve assurance while providing assurance over the AI systems themselves. The same technologies that improve analytical capability also introduce new risks relating to explainability, evidence integrity, data quality, privacy, and accountability.
AI tools now read and write code, search business data, run commands, change repositories, and call external systems. Across eight AI tooling sources, each chapter answers what the source records, what it misses, which fields matter, what the data can support, and where its limits begin.
An ML-BOM (Machine Learning Bill of Materials) is a CycloneDX BOM document designed to address the unique complexities and risks of AI/ML systems. It provides a detailed inventory of all components, configurations, and processes involved in the development, training, deployment, and hosting
The forecasts show a consistent pattern: participants assessed baseline risks of catastrophic cyber harms in 2026 as low but non-negligible, and they expected some AI capabilities to substantially increase those risks, especially when AI lowers barriers for moderate-sophistication actors.
Frontier models can now autonomously discover zero-day vulnerabilities, generate working exploits, and chain complex attack paths. The time between a vulnerability being disclosed and being weaponized has collapsed. And the threat has moved up the stack
Secure the Data. Protect the Model. Control Access. Monitor Every Decision.
Between December 2021 and June 2025, the share of large- and mid-cap developed-market companies with at least one AI expert director grew from 15% to 25%. Yet only 14% of boards had effectively integrated that expertise as of mid-2025, meaning they had recruited the credential without deploying it.
When you evaluate any control in this document, ask a single question: does this make the attack impossible, or just tedious? Mitigations whose value comes from friction rather than a hard barrier degrade significantly against an adversary that can grind through tedious steps at scale.
The assessment should be completed using a combination of management interviews, sample-based evidence review, control design assessment, control operating-effectiveness testing, system walk-throughs, and independent challenge. Scoring should be evidence-based and should not rely solely on managemen
Agentic skills are becoming first-class citizens of AI workflow: reusable bundles of progressive instructions, code, resources, and operational know-how that agents can discover, load, and execute. That makes them powerful, but it also moves risk into a new layer.
AI fundamentally changes an organisation's risk profile. It expands the attack surface, increases data movement across systems, and introduces behaviour that can change over time as models are updated and interact with new data.
AI is not a single decision; it is a stack of decisions: what data goes in, how the model learns, how it is wired into the business, how it is watched, and how it is proven. Governance must be a stack too. Every part of an AI system gets its own layer of controls, with its own owner and its own evid
AI security is rarely treated as a cultural problem. Most organizations manage AI risk with technical controls, and do very little about the risks that people introduce: shadow AI, blind trust in hallucinated output, unintentional IP leakage and more.
ISO 42001 does not make your AI trustworthy. It makes your AI governance auditable, and that is the point. One warning: an ISO 42001 certificate is not solely EU AI Act compliance. It is evidence of governance, not a legal safe harbour.
Mechanisms at the model level to ensure that AI Agents meet safety standards are insufficient. Implementing and maintaining those guardrails once models are deployed in the enterprise context are necessary.
This paper examines how legal responsibility should be allocated when AI agents act autonomously, use tools, interact with third parties, and cause harm. It focuses on civil liability and private law, especially Singapore law, while recognising that agentic AI may also raise other legal issues.
The Model AI Governance Framework for Agentic AI gives organisations a structured overview of the risks of agentic AI and emerging best practices in managing these risks. If risks are properly managed, organisations can adopt agentic AI with greater confidence.
Resilient Defence AI is not a self-contained software and hardware problem, but a dependent system integration problem of constrained power and resources. AI capabilities rely on energy-intensive compute, specialised hardware, and complex supply chains.
Whilst publication in this field has continued at pace, there have been limited efforts to objectively understand which aspects of AI security are well studied, which ought to be studied, or where the gaps are.
The single most consequential failure in enterprise AI adoption is not technical — it is the collapse of governance at the point of adoption. Organizations are investing at historic levels in AI technology while simultaneously failing to build the organizational infrastructure that makes them defens
The system of decision rights, policies, controls, accountability, and oversight used to direct how AI is selected, built, bought, deployed, monitored, and retired. Good AI governance connects business value with risk management and stakeholder protection.
Effective AI governance, however, is not merely about placing limits on models; it is about ensuring the integrity, accountability, and security of the data ecosystems that power them.
Over the three years this report series has tracked, it has become increasingly clear that China’s approach to AI safety and governance extends far beyond content control. With the rise of autonomous agents, the concern has expanded to what AI does and what it does to people and society.
If you don't manage AI risk properly, one of two things happen. Either people innovate wildly and you're exposed – or they stop innovating because they don't feel protected, or it's too hard. Either way, you lose.
Curated Library of AI Governance Resources