The ECB's 31 October letter, and the AI you already run.
The ECB asks supervised significant institutions for an ICT-wide action plan. What belongs in that plan, and where can evidence from connected AI workflows help?
// Blog
Operating with AI. What we learn and build.
What did the AI do? Who authorised it? What can a reviewer check? Practical articles on controls, evidence and the limits of both.
Post-quantum sealing for long-lived assurance.
A signature made today may need to be checked years from now. How do post-quantum signing, key custody and migration help preserve that evidence?
What makes an AI evidence pack defensible?
You have the screenshots, exports and logs. What else does a reviewer need to check their integrity, origin and relationship to the event?
On-behalf-of: recording who your AI acted for.
A refund appears under an agent's identity. Who gave it authority to act? The distinction between identifying the software and recording who it acted for.
DORA incident reporting: why evidence must exist before the incident.
An incident starts a reporting clock. Can your team retrieve the records it needs, or must it reconstruct the story first?
Offline verification: check it yourself, without trusting the vendor.
What does an offline verifier actually prove? A guide to checking exported records, the trust material you need and the questions a signature cannot answer.
The approval-to-execution gap.
Does the submitted action match the approval? Why matching timestamps cannot answer that question, and how a supported workflow can check the relationship.
Shadow AI: you cannot control what you cannot see.
A colleague pastes a customer thread into a chatbot. What can your connected controls see, and which routes are outside their view?
Why an ordinary log is not independent proof.
Logs can be evidence. Their value depends on how they are captured, protected and checked. What changes when a reviewer can verify a sealed record independently?
Start with one real workflow.
Choose a valuable workflow that needs stronger control or a provable human decision. We will agree the relevant Athena modules, integration boundary, evidence limits, acceptance tests, timetable and commercial scope in writing.