# Insight — Enrique (Rick) Sanchez, Jr. > SurvAIable, the Black Lion Integrated AI Framework and its crosswalk matrix, and current writing. Source: https://ricksanchez.org/insight.html · Updated: 2026-09-16 · Contact: rick@ricksanchez.org · (877) AI-CAIO-1 --- ## Insight. Two things I built, and what I am working through in public. The framework is the method; SurvAIable is how an engagement finds its starting point; the posts are the thinking before either one is finished. ### SurvAIable A secure, AI-driven survey and analytics platform that gathers structured, role-based input from across an organization and turns it into a clear, defensible picture of how AI is actually being used — formally and informally — where it creates exposure, and where it could create value. Simple for the people answering. Strategic for the people reading. A governance policy written from assumptions governs an organization that does not exist. This is how I find out what actually exists. - AI usage trends by role and function - Perceived benefits and risks of AI tools - Organizational readiness for adoption - Priority areas for investment or controls #### Policy Grounded in Reality Responses reveal which AI tools are in use, sanctioned or not. That becomes a tailored AI governance policy and acceptable use policy built on real behavior rather than assumptions — addressing risk, compliance, and security while fitting how the organization actually operates. #### Opportunity, Not Only Risk The same instrument captures friction, inefficiency, and unmet need — surfacing high-impact automation candidates, the places employees are already experimenting, and the processes best suited for AI augmentation. #### Confidential by Design Participants enter through a shared credential, so no response is personally identifiable and everything is analyzed in aggregate. Results reach authorized administrators only. Candor is a design requirement, not a hope. ### The Black Lion Integrated AI Framework™ I do not sell policies. I sell an operating model. Six layers, built so each one produces the evidence the layer above it needs — board strategy at the top, the control an engineer runs on a Tuesday at the bottom. One obligation, traced across every framework that governs it, ending in the policy your organization actually adopts. This is what turns overlapping standards into a single defensible system. ### What I'm Talking About Right Now. ### An algorithm just failed. That is the system working. Quantum-Ready Governance · Post 3 of 7 — HAWK survived two years of expert review, then about sixty hours of AI-assisted cryptanalysis. It withdrew before standardization — which is the process doing its job. The governance lesson is that your architecture has to assume algorithms can fail. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_postquantumcryptography-quantumready-cryptoagility-activity-7504725442130493441-RDaZ) ### You don't need to understand quantum. You need to know two dates. Quantum-Ready Governance · Post 2 of 7 — NIST's draft transition plan puts a schedule on retiring today's public-key cryptography: deprecated after 2030, disallowed after 2035. For businesses, 2030 is the date that will actually bite. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_postquantumcryptography-quantumready-cyberrisk-activity-7503691633574481920-r2BB) ### The threat arrives before the machine does. Quantum-Ready Governance · Post 1 of 7 — Executive Order 14412 describes the whole threat model in one section: adversaries copy encrypted data now and decrypt it later. It changes the question from when quantum arrives to how long your data must stay secret. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_postquantumcryptography-quantumready-cyberrisk-activity-7501890151590092800-ORiO) ### Model weights: when your data becomes the model. Where Your Data Lives in AI · Post 2 — Delete the prompt and the influence can remain. Six questions a model-weight governance review should answer — and what the FTC, NYT v. OpenAI, and EU AI Act Article 10 signal about getting them wrong. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_aigovernance-artificialintelligence-aicompliance-activity-7488830099081875456-c97F) ### “We don't train on your data” tells you almost nothing. Where Your Data Lives in AI · Post 1 — A typical LLM system holds nine data stores, each with its own retention, deletion, access controls, and breach surface. When you evaluate an AI vendor, don't ask one question. Ask nine. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_aigovernance-dataprivacy-artificialintelligence-activity-7481247199587090432-C2dY) ### Google didn't invent board accountability for AI. NIST got there first. Frameworks · NIST AI RMF — Google's framework isn't a replacement for the NIST AI RMF — it's a translation layer for it, speaking the language boards already use. Frameworks don't govern AI. People do. [Read on LinkedIn](https://www.linkedin.com/posts/ricksanchez1_aigovernance-artificialintelligence-nist-activity-7476830710893289472-LdY-) ### Start Now — Protect Your Customers and Your Organization. You do not need a finished program to begin. Governance can start with what you already have today — policies, contracts, and workflows. Let's build a plan that reduces risk, protects the people who trust you with their data, and accelerates responsible innovation.