The AI governance reference library.
The Hub is a master repository for AI governance practice. Three collections — frameworks, tools, guides — built from primary sources and re-authored for operational use. This is where "AI Human Proof" gets translated into what organisations actually build.
Deployment Frameworks & Methodologies
The governance architectures and regulatory regimes that define AI deployment practice. EU AI Act, NIST AI RMF, ISO/IEC 42001 — re-authored for the teams that build and operate AI systems.
Colorado's ADMT and Chatbot Safety Regime: What Applies, When, and What Is Still Draft
Colorado enacted two AI statutes taking effect 1 January 2027 — the ADMT Act for consequential decisions and the Chatbot Safety Act for public conversational AI — and on 11 August 2026 the Attorney General filed proposed implementing rules. This page separates what is enacted law from what is still a draft, and sets out what a deployer should be building now.
EU AI Act Compliance: What Businesses Actually Need to Do
The EU AI Act is the world's first comprehensive AI regulation with legal teeth, and its deadlines moved in July 2026. The Digital Omnibus — Regulation (EU) 2026/1744 — came into force on 27 July 2026, deferring high-risk obligations to December 2027 while leaving the Article 50 transparency duties on 2 August 2026. This breakdown gives the timeline as amended, the obligations by role, and the capabilities a deployer must build.
GDPR Article 22: The Automated Decision Rule That Already Binds You
Long before the EU AI Act, GDPR Article 22 restricted decisions made solely by automated means. The CJEU's SCHUFA judgment widened it considerably — and confirmed that a human who rubber-stamps the algorithm does not make a decision human. For most European deployers this is the obligation that bites first.
ISO/IEC 42001: The AI Management System Standard, Operationalised
ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence — and the only one that produces an audit certificate a customer or regulator will recognise. This breakdown covers the clause structure, the 38 Annex A controls, and how certification maps onto EU AI Act obligations.
AI Tool Governance Audits
Independent governance audits of the leading commercial AI platforms. What each tool provides, what the documentation doesn't disclose, and what your organisation must build to meet the standard.
Evaluating Claude for Enterprise: Governance, Controls, and What the Documentation Doesn't Say
Anthropic's Claude is among the most governance-forward commercial LLMs available. This breakdown examines Claude's actual safety architecture, enterprise controls, and the gaps organisations need to fill themselves — using primary Anthropic documentation and independent evaluations.
OpenAI GPT-4 in Enterprise: A Governance Audit Framework
GPT-4 remains the most widely deployed frontier model in enterprise environments. This breakdown audits the governance controls available to operators — what the API exposes, what the documentation promises, and what independent testing reveals about the gaps.
How-To Deep Dives
Step-by-step implementation guides for the operational governance controls that frameworks mandate and tools don't provide. Built for the people who have to actually implement them.
Building a Tested Incident Response Capability for AI Systems
The AI Human Proof standard requires a documented, tested process for detecting, triaging, responding to and learning from AI incidents. Most organisations have the document and have never run the test. This guide sets out what a tested capability contains, using two 2026 incidents where the gap between having a process and having run it is visible in the public record — including a state Attorney General's subpoena that shows exactly what an organisation is asked to produce when an incident becomes compulsory process.
Designing Human-in-the-Loop Systems That Actually Work
Human-in-the-loop (HITL) is cited in almost every AI governance framework as a key mitigation. It is also one of the most poorly implemented governance controls in practice. This guide separates effective HITL design from performative HITL that creates the appearance of oversight without the substance.
How to Build a Pre-Deployment AI Risk Assessment
Most AI incidents are not failures of the model — they are failures of the deployment process. A structured pre-deployment risk assessment is the single highest-leverage governance intervention available to any organisation deploying AI. This guide shows exactly how to do it.