Journal
Field notes from inside the audit.
Short essays on small-business automation, AI governance in practice, and the gap between "we use AI" and a system that actually survives a regulator's look.
Field notes · 2026-05-30
Is my AI agent a high-risk system under the EU AI Act? The classification decision tree.
The copyable five-gate decision tree, applied to an autonomous agent. Walk Article 5 to Article 50 in the right order and you can decide whether your agent is in scope in about fifteen minutes, with the multi-agent rule and three worked examples.
Read the post →Field notes · 2026-05-30
EU AI Act logging requirements: which logs, what form, how long.
The reference answer to the question I get on every audit call. Which records a high-risk AI system has to produce, what shape they have to be in, how long you hold them, and whether the obligation is even yours or your vendor's.
Read the post →Field notes · 2026-04-20
The EU AI Act August math.
August 2, 2026 is not one deadline. It is five, stacked in the same week. The one most SMBs are going to miss isn't the one the law firms are writing about.
Read the post →Field notes · 2026-04-20
I ran 12 AI audits this quarter. Here's what every one of them failed on.
Twelve audits across agencies, contractors, clinics, and two e-commerce brands. One failure pattern showed up in every single report. Nobody saw it coming, and it is the one thing the EU AI Act will land on first.
Read the post →