The Schellman Blog

Over the past year, I've spent a lot of time talking with AI founders, enterprise executives, CISOs, and technology leaders about the opportunities and challenges associated with artificial intelligence. There's an incredible amount of excitement about what AI can do, but there's also a growing recognition that developing powerful technology and getting enterprises comfortable deploying it are two very different things.

Data centers are the most talked-about infrastructure of the AI era. Coverage focuses on power, land, and GPUs. Far less attention goes to what lets a customer trust a facility with sensitive data: independent assurance.

I remember sitting in a Major Firms Group meeting several years ago when Barry Melancon, then CEO of the AICPA, said something that has stayed with me ever since: CPAs have always been in the trust business.

The security field is drowning in two kinds of noise.

Most enterprise leaders have some level of awareness of emerging and upcoming AI regulations that may apply to their organization in the near future. Yet, not all have actually started preparing for enforcement of those regulations to take effect.

If you're building or deploying AI systems, you've likely heard of the numerous governance acronyms flying around, including ISO 42001, EN 18286, AIUC-1. What you may not realize is that each framework addresses a specific purpose, so you likely need to comply with more than one.

There have been a lot of conversations about AI safety lately, but one idea really caught my attention: Anthropic CEO Dario Amodei spoke about the need for independent evaluators to have deeper access to AI companies and their models so they can actually test whether the safety measures being put in place are functioning.

AI governance has become one of the most consequential disciplines impacting enterprise-level organizations today. It determines not only whether organizations can manage AI-related risks, but whether they can build and prove the trust, accountability, and operational confidence needed to use AI effectively. Despite its importance, governance is often treated as a supporting function focused on policies, checkbox compliance procedures, and assigned responsibility.