The Schellman Blog

Most enterprise leaders have some level of awareness of emerging and upcoming AI regulations that may apply to their organization in the near future. Yet, not all have actually started preparing for enforcement of those regulations to take effect.

If you're building or deploying AI systems, you've likely heard of the numerous governance acronyms flying around, including ISO 42001, EN 18286, AIUC-1. What you may not realize is that each framework addresses a specific purpose, so you likely need to comply with more than one.

There have been a lot of conversations about AI safety lately, but one idea really caught my attention: Anthropic CEO Dario Amodei spoke about the need for independent evaluators to have deeper access to AI companies and their models so they can actually test whether the safety measures being put in place are functioning.

AI governance has become one of the most consequential disciplines impacting enterprise-level organizations today. It determines not only whether organizations can manage AI-related risks, but whether they can build and prove the trust, accountability, and operational confidence needed to use AI effectively. Despite its importance, governance is often treated as a supporting function focused on policies, checkbox compliance procedures, and assigned responsibility.

Most enterprises have a sense of who owns AI risk, yet few know what happens when that risk turns into an incident.

On nearly all sales calls, we receive questions around how Schellman is using AI on the pen test team, how AI is going to change our processes, and how fast these changes will be implemented.

This article was drafted based on a panel discussion between Schellman's Danny Manimbo, an AI-focused attorney, and an enterprise AI risk management leader. Watch the full conversation here: AI Governance in an Era of Evolving Regulation.

A Q&A about the EU AI Act with Schellman CEO Avani Desai on risk classification, AI literacy, and the August 2 deadline