AI oversight and regulation
Every emerging AI regime asks a version of the same question: which natural person was accountable, and what did they see. These essays map the statutory language onto records a system can actually produce.
All 12 essays
Article 14 asks who the natural person was. Your logs do not know.
The EU AI Act requires that high-risk systems be overseen by natural persons and that records identify who verified what.
What California's automated decision rules ask of human review
California's ADMT rules give consumers rights around automated decisions. Answering a request about human review needs records most firms lack.
Self-authenticating records: why some logs are admitted and others are not
Evidence rules let some electronic records authenticate themselves. A plain application log does not qualify; a digitally identified record can.
Adverse action under algorithmic discrimination law
State AI acts require deployers to explain adverse decisions and demonstrate they guarded against discriminatory outcomes.
Turning AI risk framework language into tests that pass or fail
Risk frameworks describe outcomes: accountability is established, oversight is exercised, decisions are traceable.
Sign-all and the ambient scribe: what the clinician actually attested
Ambient documentation tools generate notes a physician signs. Bulk signing was already a problem; generated content makes it consequential.
Consumer protection liability when the bot makes the promise
Consumer protection law holds a business responsible for representations made in its name. Nothing requires those to come from a person.
A signed PDF and an action receipt are not the same artefact
Document signature frameworks were built for agreements people read. API execution needs something a machine verifies against a payload.
Board oversight of autonomous systems that can cause physical harm
When an autonomous system controls something physical, governance stops being about data and starts being about who set the safety envelope.
Sectoral AI regulation: one control, several regulators
A regime that empowers existing sector regulators rather than passing a single AI statute produces overlapping expectations.
Evidencing human oversight for an AI management system audit
Management system certification is an evidence exercise. The oversight clauses are where organisations most often present intent and get asked for operation.
Auditing across vendors who will not give you their database
A workflow across four providers yields four incompatible, partial, redacted log exports. Reconciling them is most of an auditor's time.