by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Sep 16th, 2026
I wrote about the EU AI Act in February and August last year. A lot has happened since, and I see a dangerous misunderstanding spreading, so let me check where we are. In June the EU adopted an amendment to the AI Act, the so called digital omnibus on AI. It postponed the requirements for […]
Posted in Business, Security Architecture on Jul 31st, 2026
With Project Perception and similar systems, AI agents will soon take real actions in our environments: isolating machines, changing configurations, closing attack paths. For management, the question is how to keep control. The principle I believe in is simple. Agents do the work. Humans own the judgement. That means a few things in practice. Define […]
Posted in Business, Security Architecture on Dec 17th, 2025
A last business post for the year. What does it cost not to govern AI? It is tempting to see AI governance as a cost and a brake. Policies, inventories, assessments, training. But look at the other side. Data leakage. Confidential information pasted into an external service, or overshared data surfaced by an internal assistant. […]
Posted in Business, Security Architecture on Nov 26th, 2025
We are approaching the end of the year, and many organisations have spent it writing AI policies and setting up committees. Here is what I think separates AI governance that works from AI governance that only looks good. It starts with an inventory. You need to know where AI is used: tools, features in products […]
Posted in Business, Security Architecture on Oct 29th, 2025
Everyone wants to introduce AI. Few talk about what it is supposed to run on. AI assistants and agents work with the data and permissions they get. In many organisations, that data lives in file shares with access rights nobody has reviewed in ten years, in SharePoint sites shared with ‘everyone’, in old systems without […]
Posted in Business, Security Architecture on Aug 29th, 2025
On the 2nd of August the next part of the EU AI Act started to apply: the rules for general purpose AI models, the large models that many AI services are built on. They mostly concern the companies that develop those models, with requirements for documentation, transparency, copyright and, for the most powerful models, risk […]
Posted in Security Architecture on Jun 25th, 2025
After EchoLeak, a question for management: does your risk management cover AI? In many organisations, AI arrived through the back door. A feature in a product you already used, a pilot in a department, a tool someone bought with a credit card. It never went through the normal risk assessment. AI brings some new risks, […]
Posted in Business, Security Architecture on May 28th, 2025
My previous post was about AI agents as identities. The business question is harder: who is responsible when an agent makes a mistake? Imagine an agent that handles supplier invoices. It approves a payment to a fraudulent account because the invoice looked right. Or an agent in customer service that promises a refund the company […]
Posted in Business, Security Architecture on Mar 31st, 2025
Following the AI Act post last month, many have asked for advice on an AI policy. Here is what I think it should cover, in plain language. Which tools are allowed. List the approved AI services and how to request new ones. Be clear that unapproved services must not be used with company data. What […]
Posted in Business, Security Architecture on Feb 12th, 2025
On the 2nd of February the first parts of the EU AI Act started to apply. Many in management have heard of it, few have read it. Here is what matters now. The first rules are prohibitions. Certain uses of AI are now banned in the EU, for example systems that manipulate people in harmful […]