Resources
Whitepapers
We are writing a small number of longer papers on problems that do not fit in a blog post. None are published yet. The titles below are planned; subscribe and we will email you when each one is released.
Planned titles — coming soon
| Title | What it will cover |
|---|---|
| Governing AI agents: least privilege, approvals and containment | Why agents need different controls from models; tool manifests, default-deny, approval thresholds and kill-switch design (EI-07, IS-11, IS-13, IS-15) |
| Evidence, not assertions: designing an AI assurance programme | Evidence labels, control testing, tamper-evident logs and measuring time-to-produce evidence (SE-01, SE-05, SE-08) |
| Risk tiering that people trust | Building tier criteria from risk appetite; calibrating triage; human confirmation (AO-04, EI-02, GL-01) |
| One control set, many frameworks | How to use indicative mappings across NIST AI RMF, ISO/IEC 42001 and the EU AI Act without overclaiming |
| The inventory problem: finding and owning enterprise AI | Discovery, reconciliation and attestation for models, agents and embedded vendor AI (EI-01, EI-08, EI-09, EI-11) |
VERITRAIL controls cited
- EI-07 Agent and tool registryNIST AI RMF: GOVERN 1.6, MAP 4.1ISO/IEC 42001: A.4.4, A.6.2.3EU AI Act: Art. 11
- IS-13 Human approval for high-impact actionsNIST AI RMF: GOVERN 3.2, MANAGE 2.2ISO/IEC 42001: A.9.2, A.6.2.6EU AI Act: Art. 14
- SE-05 Audit-ready evidence packsNIST AI RMF: GOVERN 1.4, MEASURE 2.9ISO/IEC 42001: 7.5, 9.2EU AI Act: Art. 11, Art. 18
- EI-02 AI risk classification and tieringNIST AI RMF: MAP 1.1, MAP 1.5, GOVERN 1.3ISO/IEC 42001: 6.1.2, A.5.2EU AI Act: Art. 6
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
In the meantime
- Read the VERITRAIL Enterprise Blueprint, available now.
- Read the launch articles on the blog.
- Take the maturity self-assessment.
Use the form on this page to subscribe. We send no more than one or two emails a month and you can unsubscribe at any time. See the privacy notice.
Subscribe
Last reviewed: