From principles to records
Every organisation building with AI has a page of principles: fair, transparent, accountable, human-centred. Nobody disagrees with them, which is the first sign that they are not doing much work. A management standard asks a harder question, show me where that was decided, by whom, and what you did when the answer was uncomfortable.
That shift, from stated intent to producible evidence, is the whole of the change. It moves governance out of the launch review and into the ordinary week.
A principle you cannot produce a record for is a preference.
The work happens before training
- Purpose: what decision is this system taking part in, and who is affected when it is wrong?
- Data provenance: where did this come from, what was it collected for, and are we allowed to use it this way?
- Fallback: what happens when the system is unavailable or uncertain, and has anyone rehearsed it?
- Ownership: a named person accountable for the model in production, not a team inbox.
None of these are model questions. They are all answerable before a line of training code is written, and answering them late is what turns a two-week integration into a two-quarter negotiation.
Living with it
The operational cost of a standard is real: monitoring that runs whether or not anyone is watching, reviews scheduled by drift rather than by calendar, and a register that someone has to keep current. The return is that the difficult questions arrive early, when the answer is still cheap.
That is the honest case for certification. Not that it makes a system trustworthy, nothing does that on its own, but that it makes an untrustworthy system visible while there is still time to fix it.
