Two things I built, and what I am working through in public. The framework is the method; SurvAIable is how an engagement finds its starting point; the posts are the thinking before either one is finished.
A secure, AI-driven survey and analytics platform that gathers structured, role-based input from across an organization and turns it into a clear, defensible picture of how AI is actually being used — formally and informally — where it creates exposure, and where it could create value. Simple for the people answering. Strategic for the people reading.
A governance policy written from assumptions governs an organization that does not exist. This is how I find out what actually exists.
Responses reveal which AI tools are in use, sanctioned or not. That becomes a tailored AI governance policy and acceptable use policy built on real behavior rather than assumptions — addressing risk, compliance, and security while fitting how the organization actually operates.
The same instrument captures friction, inefficiency, and unmet need — surfacing high-impact automation candidates, the places employees are already experimenting, and the processes best suited for AI augmentation.
Participants enter through a shared credential, so no response is personally identifiable and everything is analyzed in aggregate. Results reach authorized administrators only. Candor is a design requirement, not a hope.
I do not sell policies. I sell an operating model. Six layers, built so each one produces the evidence the layer above it needs — board strategy at the top, the control an engineer runs on a Tuesday at the bottom.
| Governance Topic | ISO 42001 | NIST AI RMF | ISO 27001 | EU AI Act | TRAIGA | Policy |
|---|---|---|---|---|---|---|
| Human Oversight | ✓ | GOVERN | — | ✓ | ✓ | AI-HO-001 |
| AI Risk Assessment | ✓ | MAP | ✓ | ✓ | ✓ | AI-RISK-001 |
| Third-Party AI | ✓ | GOVERN | ✓ | ✓ | ✓ | AI-VENDOR-001 |
| Incident Response | ✓ | MANAGE | ✓ | ✓ | ✓ | AI-IR-001 |
One obligation, traced across every framework that governs it, ending in the policy your organization actually adopts. This is what turns overlapping standards into a single defensible system.
HAWK survived two years of expert review, then about sixty hours of AI-assisted cryptanalysis. It withdrew before standardization — which is the process doing its job. The governance lesson is that your architecture has to assume algorithms can fail.
NIST's draft transition plan puts a schedule on retiring today's public-key cryptography: deprecated after 2030, disallowed after 2035. For businesses, 2030 is the date that will actually bite.
Executive Order 14412 describes the whole threat model in one section: adversaries copy encrypted data now and decrypt it later. It changes the question from when quantum arrives to how long your data must stay secret.
Delete the prompt and the influence can remain. Six questions a model-weight governance review should answer — and what the FTC, NYT v. OpenAI, and EU AI Act Article 10 signal about getting them wrong.
A typical LLM system holds nine data stores, each with its own retention, deletion, access controls, and breach surface. When you evaluate an AI vendor, don't ask one question. Ask nine.
Google's framework isn't a replacement for the NIST AI RMF — it's a translation layer for it, speaking the language boards already use. Frameworks don't govern AI. People do.
You do not need a finished program to begin. Governance can start with what you already have today — policies, contracts, and workflows. Let's build a plan that reduces risk, protects the people who trust you with their data, and accelerates responsible innovation.
