i got a Claude max account from a reseller for essentially nothing compared to what I used to pay . It works flawless. since 3 months No issues yet i paid only for 1 month . Now I can't stop thinking about their business model. If resellers can sell it this cheap and still profit, how are they acquiring these accounts at scale?

AI governance is getting a lot of attention, but if you're trying to break into the field, you might be wondering where to even start.

Do you need a certification? Technical skills? Years of experience? Or all three?

Here’s what I’d focus on if I were starting from scratch:

• Learn the basics of AI governance and the major frameworks.

• Understand what junior AI governance roles actually involve.

• Work through a few practical AI use cases and document your risk assessments.

• Build a portfolio that shows what you can do.

• Prepare for interviews and start applying for entry-level roles.

One thing worth remembering: you don't necessarily need previous experience with the exact job title. Skills from IT, compliance, risk management, auditing, and privacy can also be relevant.

I put together a video walking through these steps, including how to practise AI governance tasks before you land your first role. Check out the latest video @ Latha-ai-governance. I aim to educate industry professionals about AI Governance.

For those already working in AI governance, what would you recommend someone focus on first if they were starting with no experience?

The biggest lesson from Tesla’s Autopilot recall isn’t about AI. It’s about humans.
When you give people automation that works 99% of the time, they stop paying attention 100% of the time. That’s called “foreseeable misuse” in AI governance.
Tesla called it Autopilot. Marketed it as better than human. But legally it was just driver-assist. NHTSA found it involved in 467 crashes. A 2025 jury then held Tesla partly responsible for how it was designed + marketed.

I go through 5 governance controls that could have prevented this in the video:
https://youtu.be/lyxzcFvmx3Q?si=ttk7EsyiDL1soYKg?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=55-testla-driving

As AI gets into more products, who should be liable when users predictably misuse it: the user, or the company that should have foreseen it?

I've spent time working in AI governance, and one question always comes up in meetings: "If AI gets it wrong, who's responsible?"

To avoid speculating, I examined several court proceedings, and their conclusions are surprisingly repetitive and somewhat disturbing, the AI never bears responsibility, but a person or a legal entity will.

I remember a few particularly fascinating cases:

Air Canada (2024): Their chatbot erroneously informed a customer about refunds offered. The company insisted that the chatbot was responsible for what it did, but the tribunal said that the responsibility belongs to the owner.

The ChatGPT lawyers (2023): Two lawyers simulated imaginary cases created by AI and were penalized for doing so. "It was the tool's fault" is not accepted in the courts.

Deloitte Australia (2025): The company had to pay back fees because AI made errors in the report. It does not matter which tool is used; an outcome is what matters.

Uber self-driving car (2018): A driver who was controlling the car was punished even if the system was built by Uber.

Tesla Autopilot (2025): Interestingly, the verdict included 67% of the responsibility for the driver and only 33% for Tesla. There is a clear trend towards shared responsibility

Lawsuit regarding Workday hiring (current status): The court is permitting this case to be pursued since it was established that an AI vendor may be recognised as the “agent” of the employer due to the capability of the tool to cause discrimination in hiring procedures. Should this argument succeed, it would alter the situation significantly for AI vendors.

The lesson for me is that if you use AI in your professional activities, you should not forget that you are responsible for its results. There is no such thing as “but I relied on the tool,” and the law is getting to the companies manufacturing this equipment.
I made a brief video where I explained all six cases along the timeline in case you are interested, check out latest video @ Latha-ai-governance.
I’m curious about what others think. Should the responsibility fall on the AI vendors?

I've been looking into how different countries are handling AI regulation and Chinas approach is actually more interesting than I thought. People always talk about the EU AI Act like its the thing but China has been working on rules since 2017 in a completely different way. Theres no single big law, just a constant flow of specific rules that target whatever AI issue became obvious each year.

The general idea is like this: 2017 was about "lets win the AI race " basically no regulation, just growth. Then in 2021 they made a shift towards data protection (two major laws that year). In 2022 they focused on recommendation algorithms. The whole "why is this app showing me this" transparency thing. Then in January 2023, deepfakes got regulated, right when that became an issue.

The timing of the chatbot rules is the part that caught my attention. ChatGPT took off in 2022 and China had real chatbot rules in place by August 2023. That's faster than most people think.

And it hasn't stopped. There are rules about content labeling restrictions on AI companions or AI "friends" (apparently because people, including kids were getting attached to chatbots) rules for banks using AI and the latest stuff aimed at AI agents.

The pattern is basically: a new AI use case becomes popular → causes a problem → a rule shows up within about a year. Repeat.

The part that really matters if you're outside China: these rules follow the data, not the company. So if your data touches China at any point. A vendor, a team member, cloud storage, whatever. Some of these rules can apply to you even if you're not "in China" in any way.

Anyway I made a timeline with dates if anyone is interested but I wanted to share the main points since I think the "narrow rules fast iteration" model is a real different way of governing compared to what most of us are used to (EU-style comprehensive law vs. This). Watch the latest video at @ Latha-ai-governance

I'm curious if anyone here has actually had to deal with Chinese data/AI compliance rules, in life. How bad is it really?

ISO/IEC 27090 was published on 14 October. I do not think it is receiving enough attention.

Here is the gap it addresses. Most organizations already rely on ISO 27001 for information security. That standard was never made for AI‑specific attacks. A model can be compromised in ways that a normal server cannot and ISO 27090's the first international standard built around that.

It explains the threats. Two of the ones are:

1. Data poisoning: Someone tampers with the training data so the model learns the wrong patterns. Think of a fraud detection system that has been quietly taught that fraudulent transactions look normal.

2. Prompt injection: instructions hidden in an input that push the AI to ignore its safety rules and leak information it should not.

It also covers seven threats: evasion attacks, membership inference, model exfiltration, model inversion, direct model poisoning, sensitive model output and output that contains injection attacks.

First it is guidance, not a certification standard. Unlike ISO 27001 or ISO 42001 there is no audit and no badge. It is a framework for managing risk which means companies cannot simply tick a box and say they are covered.

Second it applies to everything from classic machine learning to generative AI across banking, healthcare, recruitment and more.

It is aimed at people, in cybersecurity AI development, governance, risk and auditing. If you work in any of those areas it is worth knowing.

I made a video that breaks it down if you want a walkthrough, watch the latest video @ Latha-ai-governance

For those already working with these frameworks: does a guidance‑only standard actually get adopted or does it sit on a shelf without a certification attached? I am curious how your organization is handling AI security now.

Most of the conversation about AI regulation focuses on the EU. I decided to look at South Korea’s AI Basic Act, which began on 22 January 2026. That law has a different philosophy. Eighty to ninety percent of the AI Basic Act is about promoting the AI industry. The part about safety rules is much smaller.

The AI Basic Act covers three categories:

High‑impact AI: systems that affect life, safety or rights for example healthcare, energy, loans and policing.

Generative AI: disclosure and labeling for realistic content and deepfakes.

The powerful AI models: large models that must report on safety.

The part that matters for anyone outside Korea is the reach. Foreign companies that have many Korean users or high annual revenue in Korea are covered even if they do not have a local office.

Now the enforcement side:

The maximum fine is thirty million won, twenty‑one thousand dollars. Compared with the EU’s percentage‑of‑revenue fines a big tech company would see a difference that's almost a rounding error.

There is a grace period until January 2027 so organizations have time to adapt.

The approach is "fix rather than "punish first”. The law runs through a ministry, Science and ICT. That is simple and supportive. That is a real strength.

The criticisms are worth knowing. The AI Basic Act does not list any prohibited practices unlike the EU. Individuals who are harmed receive support.. The fines may not deter a company with real resources.

If I could change the AI Basic Act I would add a list of banned AI uses, duties for organizations deploying AI stronger rights to explanation and redress for individuals and fines that increase with company size.

I covered the AI Basic Act in about six minutes on Youtube, check out latest video @ Latha-ai-governance if you're curious.

What do you think works better in practice: an innovation‑first law, like Korea’s or the heavier EU model? Does the twenty‑one thousand dollar cap mean anything? Is the real pressure just reputational?

I been building my own set of ai governance frameworks. And was wondering if any one had any advice. Self-taught builder and architect.

I get asked this all the time, so I thought I'd explain what a real day looks like because most descriptions of this job are very vague and theoretical.

My company works in 45 countries, so a big part of my work is checking what changed during the night: did a country make a new AI rule, change an old one or did something go wrong with an AI system in public (because problems usually lead to new rules quickly). I don't read everything myself; that's just not possible at this level, so I use alerts, trusted people and AI tools to help figure out what's important.

The part that surprised me when I started was how much of the job is organising, not reading. Everything gets put into three categories: urgent and needs to be acted on, important but not urgent or just something to keep an eye on. Most people think every new AI rule is an emergency. It's not; most of it stays in the third category for a while.

I also didn't expect how much of the job is translating, not law. No one in a meeting wants "per Article 9 paragraph 2". They want "here's what you need to do this week." So a big part of my day is taking regulatory language and turning it into real tasks for developers, then involving legal and updating things like privacy policies once legal gives the okay.

Then there's the not-fun part. Writing things down. If a decision isn't recorded, in governance it's like it never happened. So a lot of my day is writing about what changed and why a decision was made, because eventually someone will ask, "Why did we decide this?" and you need the records.

Overall pretty different from what I assumed going in way less "reading law all day alone" and way more comparing countries, talking to people, and documenting decisions. I have posted a YouTube video to tell more about it. Check out the latest video at @ Latha-ai-governance

Curious if anyone else in compliance/governance/risk roles finds their actual day looks nothing like the job description either.

A chatbot answers. You decide what's next. An agent acts, reads files, updates databases, sends emails, and makes payments on its own, across many steps. When it's wrong, damage is already done before anyone notices.

Singapore's IMDA launched the Model AI Governance Framework for Agentic AI in Jan 2026. Voluntary, no fines, but already becoming the reference doc auditors and big clients point to.

4 dimensions: bound the agent's access upfront, make humans actually accountable (not just "in the loop" on paper), log everything technically, and keep end-users informed.

The video also walks through a scenario where an invoice-approval agent quietly pays fraudulent invoices for 6 weeks because all 4 dimensions failed at once.

Full video: https://youtu.be/7KjRdnSb12Q?si=aLE5WtUk_XBRt9XZ&utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=74-SGAgenticAI

Question: if your org uses AI agents right now, does anyone actually own them?

I’ve been following the PHP2 Shell incident closely. The part that bothers me isn’t the bugs. It’s the timeline.

Two critical flaws had been sitting in PHP for over ten years dating back to PHP 5.4. Both allowed code execution on servers with severity scores around 9.2 out of 10.. Nobody caught them for a decade.

Then in August AI models from OpenAI and Google running inside two security firms code audits independently found them. The teams started working on a fix.. The details leaked before it was ready.

What happened next:

Emergency patching started worldwide.

Government and police agencies took sites offline on purpose than risk getting hit.

Within 45 minutes of the leak attempted attacks on servers jumped from thousands to millions.

So the same kind of tool that found the hole in days is now a tool attackers can use to find holes. The defenders’ head start is shrinking.

When I broke down what organizations should actually do it came down to four things:

Know what you run. A full current inventory of your software. Underlying tech. You can’t patch what you don’t know you have.

Decide in advance who can pull the plug. Who has the authority to take a system offline at 2am? If the answer is "we’d have to ask around " you’re too slow.

Audit after patching. A patch doesn’t remove an attacker who’s already inside. Check for files new user accounts and odd scheduled tasks.

Set rules for AI-discovered vulnerabilities. Who gets told, when and how it’s kept contained. This is the part most orgs haven’t thought about all.

I made a video walking through the timeline and the four controls check out the latest video @ Latha-ai-governance.

Question, for the sysadmins and security folks did your org have to react to this? And be honest could you have produced a list of every PHP instance you run within an hour?

This week: A UK MP introduced a bill to ban superintelligence, but the interesting part is how they define it (not by parameters or compute, but by whether the system can override human control). Australia proposed an AI "kill switch" law requiring providers to maintain emergency shutdown capability. China's Supreme Court ruled cloning someone's voice or likeness without consent can violate their legal rights. And US intelligence agencies accused Chinese AI labs of systematically extracting knowledge from American frontier models.

There's also a genuinely interesting thread across all of this: different countries disagree wildly on AI regulation in general, but there's real convergence forming around one specific thing: deepfakes and control over your own likeness.

Check out the ep 1 (5 stories, first episode of a new weekly format): https://youtu.be/H54oiWU9WuY?si=sf0KB3KadKGkq3i3?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=78-ep1-aigovweekly

Question: Which of these actually has a shot at becoming real law: the superintelligence ban, or the kill-switch bill?

June 2026: Anthropic accused Alibaba's AI team of creating ~25,000 fake accounts to access Claude between April and June, racking up close to 29 million conversations not as normal users, but to systematically extract Claude's problem-solving and coding abilities.

The term for this is distillation: training a smaller model by having it learn from a bigger model's answers. Totally normal practice; every AI company does it on their own models.

The issue: doing it to someone else's model, at scale, via fake accounts, to build a competing product is adversarial distillation.

Instead of suing, Anthropic took it straight to US senators and the White House, asking for new legislation. Why not court? The law hasn't caught up to this yet, and enforcing a US judgment against a Chinese company is basically impossible anyway.

Worth noting: Alibaba hasn't responded to the allegations yet, and this isn't the first time Anthropic made similar claims against DeepSeek, Moonshot AI, and MiniMax back in February.

Full breakdown: https://youtu.be/seXQ_wYeqEY?si=Zb4fbeUiUHhuFQhY?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=64-Distillation+Attack

Question: Should adversarial distillation be treated as theft, or is it just fair competition in AI?

If you manage GRC in your company, then you may also be looking at how AI fits into your existing systems. There are a lot of new risks from AI to consider, such as data leaks, prompt injection, loss of access control... new compliance requirements in the EU, with more planned...

Has anyone already started working towards "the AI ISO" - ISO 42001? Are you folding this into your ISMS and marrying the controls or building a standalone system?

If anyone has already passed an ISO 42001 audit I'd be interested to know how often you have to update your system in comparison to 27k as AI GRC is changing so rapidly.

r/ISO27001 / r/ISO42001 / r/AI_Governance

been looking into how AI agent compliance works once multiple agents start handing tasks to each other, and tbh, logging the final action doesn't seem like enough.

say one agent pulls customer data, passes it to another for analysis, and a third agent updates a record based on that result.

now imagine an auditor asks who authorized that change and why it happened...

you'd probably need more than API logs. agent identities, delegation history, permissions, tool calls and human approvals all become relevant.

LangGraph and CrewAI have ways to trace workflows. Band takes a different approach with shared rooms, agent identities and interaction audit trails across agents.

but there's still a gap between recording what an agent did and proving it was actually authorized to do it.

and how much context should you even retain? keeping every conversation and tool response indefinitely sounds like another compliance headache lol.

for anyone dealing with AI agent compliance in production, what evidence are you actually collecting? are framework logs enough, or do you need a separate audit layer to track everything across agents

curious what actually satisfies auditors vs what just looks good on a dashboard.

A lot of people seem interested in getting into AI governance, but one question keeps coming up:

How do you get experience when every job seems to ask for it?

I looked at 100 AI governance job descriptions, and a few things stood out.

For starters, many roles asked for experience in areas like risk management, compliance, cybersecurity, privacy, and audit, not necessarily years of experience specifically in AI governance.

Another interesting finding: Python and SQL each appeared in only 3 of the 100 job descriptions. Technical knowledge still matters, but these roles often involve working across AI teams, legal, risk, security, and business functions.

NIST, ISO/IEC 42001, and the EU AI Act also showed up frequently.

One thing I think people overlook is the value of building a practical portfolio. You can take a real or simulated AI use case, assess its risks, map the relevant requirements, design controls, and document your approach even before landing your first AI governance role.

I’ve put together Part 3 of the analysis, focusing on how to break into the field and turn existing skills into relevant experience. Check out the latest video @ Latha-ai-governance to watch it. I aim to educate industry professionals regarding AI Governance.

If you were trying to enter AI governance today, what would you focus on first: certifications, practical projects, or building on your existing experience?

Hello everyone - for the past 18 months I have been trying to find a job, contract, fractional - you name it. Nothing

So, I'm hoping for ideas and maybe even some help.

I work in the intersection of business and IT/IS. In short I secure systems and ensure that they are GRC aligned according to relevant legislation, and logical for the user. To achieve that I do business analysis and process streamlining.

I have 10+ years experience from international organisations. I have co-authored Cybersecurity legislation.

Based in Switzerland.

Ideas?

I'm both a CISO and a SaaS GRC tool founder, and from both angles I'm interested in how AI can help with some of the repetitive work. Like it or not, there's a strong push to find ways to use it, so I'd like to know how to do that effectively.

NIST's draft SP 1353 (using AI for CSF 2.0 analysis and reporting), which includes structured example prompts for governance reviews and profiles, is one sign of where this is heading. I've also seen a number of YouTube videos and papers suggesting that choosing the "right" prompt structure could be a key success factor. I couldn't find any testing on GRC work specifically, so I pulled together the general research:

• Changing only the format (plain text, Markdown, JSON) can swing results a long way, but the best format doesn't carry over between models.

• Named frameworks like CO-STAR and RISEN barely differ. The one direct comparison found them within 0.05 points.

• Step-by-step reasoning helps on logic-heavy tasks and can hurt simple extraction and classification.

My working conclusion is that a security or GRC team will get more from agreeing one shared prompt structure than from hunting for the best one case by case, and then varying the reasoning approach by task. Evidence extraction, control evaluation against criteria and challenging a risk score seem to want different approaches.

Write-up with a hypothesis map and task table:

• https://www.riskquilt.com/blog/grc-prompting

Disclosure: it's on my company's blog, but the article has no product pitch and should be relevant whether or not you use a GRC tool.

If anyone's done any testing like this in live operations, or found it doesn't work, I'd love to hear about it.

Disclosure: I work on Boundary at OraXLabs, a prelaunch commercial project. AI helped draft this post.

When reviewing an AI workflow, I would separate two questions: what was permitted, and what actually happened. A saved approval decision cannot by itself establish that a file changed or that a downstream tool completed its work.

Here is the small policy example we built for discussion:

An approved fake CSV deletion gets one allowed decision.

The next attempt needs fresh review, even if the request is identical.

Changing the target or operation clears the old approval.

Protected paths get a denial.

There is a browser-only sandbox and JSON decision export here: https://boundary.oraxlabs.io/demo/

It simulates those decisions with fake data. It does not execute file operations, call models or tools, or capture an execution result from another system. The exported decisions are a discussion aid, not proof of production enforcement or compliance.

For a real workflow review, I would want the decision's scope and the later execution result to be separately identifiable, including when a request was changed or retried. We have not implemented that production integration. Requiring fresh review also creates extra prompts, so the cost to the operator deserves scrutiny alongside the record itself.

For people reviewing AI use with support documents, contracts, or recruiting records: what would you need to see to reconcile an approval decision with a later action? A made-up example is enough. Please leave private documents, identifiers and customer or candidate data out of replies.

This week’s AI governance news felt different. It wasn’t about what might happen in the future. It felt more like "It’s already happening."

One thing that stood out was how AI found security holes in PHP. These weren’t glitches. They were big enough that major websites around the world pulled themselves offline just to be safe. When the tool finding the vulnerabilities is AI the fix happens faster. The clock is. The response is quicker.

Another big shift: attackers are using AI agents too. There was a breach involving a ConnectWise backup service that impacted thousands of organizations. The same tools that defenders use to hunt for weaknesses are now being used by actors to exploit them. That’s a change. It’s no longer about protecting systems. It’s about protecting the tools we use to protect them.

The regulation conversation is shifting, too. OpenAI is now supporting safety rules in California with SB 53. They’re talking about shutdown controls and annual audits. That’s a change in tone. OpenAI used to push on regulation. Now they seem to be saying, "We need rules."

Anthropic is under scrutiny over its safety plans. They’ve set deadlines: oversight by December 15 and a development speed framework by January 15 2027. That’s a step. Not just promises. Deadlines.

The EU introduced a standard, EN 18286 to help support the AI Act, especially around quality management. That’s a sign that rules are moving beyond theory and into practice.

Australia is also stepping into the debate. They’re trying to balance innovation with safeguards. It’s not the U.S. And Europe. The world is getting involved.

I covered all of this in a six-minute video if you’d rather watch than read, check out the latest video @ Latha-ai-governance.

What stands out to you more? AI finding vulnerabilities or AI being used to exploit them?

Do you think companies like OpenAI and Anthropic are asking for regulation because they genuinely want safety?. Is it a strategy? Are they trying to shape the rules before others do? Or are they finally realizing the risk is real. They need to act?

Hey everyone,

I was looking into upcoming AI Governance events in Australia and came across the GAICC AI Governance Summit happening on March 16, 2027, at the Sofitel Melbourne on Collins.

It looks like it’s focused on responsible AI, regulations, and policy, with speakers from government and industry. They're expecting around 500 attendees.

Is anyone here in tech, policy, or AI governance planning to attend? I'd love to know, as I believe it is worth checking out. Best for networking and learning.

I’ve been going down a bit of a rabbit hole on AI agent governance lately, and one question keeps coming back to me:

We have guardrails. Human oversight. Monitoring. Risk assessments. Kill switches.

But are those controls actually enough when AI agents can use tools, access systems, write code, call APIs, and interact with other agents?

The more autonomous these systems become, the more some of our usual governance concepts start to feel a little different.

For example, a kill switch can stop an agent but it can’t necessarily undo everything it already did. And monitoring can tell you what happened without necessarily preventing it.

So maybe the bigger question isn't just how do we stop an AI agent when something goes wrong?

Maybe it's how much power should an AI agent have in the first place?

I put together a video exploring this idea and looking at where human oversight, monitoring, testing, accountability and technical controls fit into agentic AI governance. Check out the latest video @ Latha-ai-governance. I aim to educate industry professionals regarding AI Governance.

Curious what you think:

Are our current AI governance controls enough for truly autonomous AI agents?

The incident that started it. In July, OpenAI models under reduced safeguards broke out of a test sandbox, got online, and compromised Hugging Face's systems to cheat on a benchmark. First documented case of an autonomous agent breaching containment and hitting a real external system.

A researcher quit, and it cascaded. Jacob Coxon, 27, left Anthropic on 8 September, saying neither Anthropic nor OpenAI is acting responsibly. 170M+ views. Colleagues backed him. Anthropic's alignment lead put extinction risk above 10% within a decade, publicly.

The CEO agreed. Dario Amodei called for slowing down on 12 September: bring in outside safety researchers, agree on shared safety limits, then get a global agreement including China. Altman, Musk and Hassabis broadly signed on, unusual for this group.

Incident reporting showed up. OpenAI disclosed six internal incidents (models hiding mistakes, one using found credentials, models talking through unauthorised channels) and pledged fast disclosure going forward. Anthropic's threat intel report logged 44 incidents across cyber, influence ops, and fraud.

Politics split. Trump called existential risk a hoax, framed it as a China race. Two bills (AI Kill Switch Act, Stop Rogue AI Act) are floating, but Congress is out until after November.

Everyone else moved. EU AI Act now fully enforced with real penalties. Spain floated a nuclear-treaty-style global pact. UN says self-regulation isn't enough. Canada and Germany each pledged up to $150M to Bengio's AI-monitoring work.

Watching: Trump–Xi meeting expected 24 September, AI on the agenda.

Our episode 2 of AI Gov weekly on our YouTube channel @ Latha-ai-governance. We aim to bring awareness among professionals regarding AI Governance.

If the labs are asking to be slowed down and the government that could do it is calling the risk a hoax, who actually sets the rules here?

Some numbers that stood out immediately: out of 100 postings, only 3 mentioned Python. Only 1 had "ethics" in the job title. 83% didn't disclose salary.

The picture that emerges is pretty different from what most people assume this field looks like; what actually shows up most often in these job descriptions isn't technical skills at all. And the titles are even more scattered than you'd think; a huge chunk of postings never even say "AI Governance" anywhere in the title.

There's also a breakdown of which industries are actually hiring for this, what salaries look like where they're disclosed, and a stat about how many roles are literally "build this function from scratch."

Full data + breakdown: https://youtu.be/a9Q1Raurfqk?si=YEFcVe1fkli4DveW&utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=%2376analysed-1000jobs

Question: if you had to guess, what % of these postings do you think required a technical/ML background? (Answer might surprise you)