Field notes
Practical writing on cybersecurity, AI governance, and the risks that live in the systems organizations actually run! Now with labs and artifacts you can use.
On 14 October 2026 the European Commission cited EN 18286 in the Official Journal, the first harmonised standard under the AI Act. Here is what the presumption of conformity actually covers, a point-by-point map of Article 17 against an existing ISO/IEC 42001 system, and the four builds most providers still have ahead of them before December 2027.
Read the postYou already run an ISMS and now you need the AI certificate too. Here is what genuinely merges, where the two standards pull in opposite directions, and how one control you build well can earn evidence toward both certificates without doing the whole thing twice.
Read the postA clean-looking knowledge-base article told a support assistant to email a customer's account to a stranger, and it did. Here are five doors prompt injection comes through, from a ticket to a retrieved document to a fetched page, the layered ISO/IEC 42001 controls that contain each, and a lab that proves no single layer is enough.
Read the postA single poisoned support ticket, and ninety seconds later a production server was gone. Explore five ways an AI agent that takes actions can fail by moving money, deleting servers, or following a document, along with the ISO/IEC 42001 control that addresses each one, plus a lab you can run and intentionally break.
Read the postAn internal copilot leaked the CEO's salary to an ordinary staff account. Here are five ways an enterprise RAG copilot goes wrong, the ISO/IEC 42001 control that stops each one, and a working lab you can download, run, and break yourself.
Read the post