✒️ Foreword
Some things are too large, complex, or inaccessible to observe directly. That does not make them unmeasurable.
Henry Cavendish did not put the Earth on a scale. He measured the almost imperceptible attraction between lead spheres and inferred something enormous from something very small.
AI governance increasingly faces a similar problem.
We want to know whether an AI system is safe, compliant, robust and under control. But much of what matters cannot be inspected directly. Models are opaque. Systems change after deployment. Third-party components sit outside our visibility. Risks emerge from interactions between data, models, users, infrastructure and organisational decisions.
So governance becomes, in part, the discipline of choosing the right signals.
Logs. Incidents. Drift indicators. Human overrides. Bias tests. Supplier evidence. Impact assessments. Security events. Complaints. Exceptions. Control failures.
None of these tells us everything. Together, they can tell us whether the system is behaving as expected and whether our assumptions still hold.
That is why mature AI governance is starting to look less like a checklist and more like an instrumentation problem. Frameworks and standards matter, but their value depends on whether they translate into observable controls, meaningful thresholds, accountable owners and evidence that can reveal when reality begins departing from the model.
The difficult question is no longer simply whether an organisation has an AI governance framework.
It is whether that framework can actually detect when something is going wrong.
Cavendish needed four lead balls and extraordinary patience to measure a planet. Governing AI may require the same intellectual move: stop waiting for perfect visibility, and get much better at measuring what we can observe.
— Kuba
Curator, AIGL 📚
☀️Spotlight Resources
Governing Intelligence: Law, Privacy, Security, and Compliance in the Age of Artificial Intelligence
What it is:
Noah M. Kenney’s comprehensive 2026 textbook on operational AI governance, spanning regulation, privacy, cybersecurity, auditing, compliance, sector-specific governance, and generative AI. Its central organizing concept is the AI Governance Stack, a five-layer model covering Data Governance, Model Governance, System Integration, Control & Monitoring, and Audit & Evidence.
Why it’s worth reading:
The book is unusually implementation-oriented for something this broad. Rather than treating AI governance as a collection of legal and ethical principles, it repeatedly translates requirements into accountable owners, controls, failure signals, escalation rules, and evidence. Particularly useful are the layer-failure concept—problems originating in data or models cannot simply be “fixed” through downstream oversight—and the extensive practical material on impact assessments, auditing, compliance programmes, incident response, third-party risk, privacy engineering, and AI security. The appendices add ready-to-adapt governance checklists, impact-assessment templates, and audit-report structures.
ISO/IEC AI Standards: Comprehensive Reference — Updated March 2026
What it is:
A compact practitioner map of the published ISO/IEC standards relevant to artificial intelligence as of March 2026. It organizes more than 35 standards across foundational concepts, governance and management, trustworthiness, data quality, lifecycle management, safety, sustainability, and conformity assessment.
Why it’s worth reading:
Its usefulness is navigational rather than explanatory: it shows how much broader the ISO AI standards ecosystem has become beyond ISO/IEC 42001. Practitioners can quickly identify supporting standards for specific governance problems—for example, ISO/IEC 23894 for AI risk management, 42005 for impact assessment, the 5259 series for data quality and provenance, 6254 for explainability, 12791 for unwanted bias, and 42006/42007 for audit and conformity assessment. For teams building an AI management system, it works well as a standards roadmap: start with the governance framework, then identify the technical and assurance standards needed to make individual controls operational and testable.
Challenges to the Monitoring of Deployed AI Systems
What it is:
A 2026 NIST report examining why post-deployment AI monitoring remains difficult despite growing agreement that pre-release testing alone is insufficient. Drawing on workshops involving government, industry and academic experts plus a review of 87 publications, it organizes monitoring into six categories: functionality, operations, human factors, security, compliance, and large-scale impacts.
Why it’s worth reading:
The report is particularly useful because it focuses on what practitioners still do not know how to do reliably. It identifies cross-cutting problems such as immature monitoring standards, limited visibility into models and downstream uses, privacy-versus-observability trade-offs, rapidly changing systems, weak incentives for incident sharing, and shortages of qualified people and compute. It also surfaces concrete design questions: what should be monitored, at what cadence, by whom, with which thresholds, and when automated monitoring requires human validation. For governance teams designing continuous assurance programmes, it is a strong checklist of the assumptions that need to be made explicit rather than quietly embedded in dashboards.
The Man Who Weighed the Earth
In 1798, Henry Cavendish effectively weighed the Earth without going anywhere near a scale big enough for the job.
He watched the tiny gravitational attraction between pairs of lead spheres, using an exquisitely sensitive torsion balance inside a sealed shed to keep air currents from ruining the measurement.
From that barely visible movement, he calculated Earth’s average density as about 5.45 times that of water.
The modern figure is about 5.51.
His result can also be converted into a value for the gravitational constant within roughly 1% of today’s accepted value.
Apparently, weighing an entire planet mostly requires four lead balls and an unreasonable amount of patience.
