Field Notes

Practitioner case studies (composite teaching cases, labeled as such) and working patterns.

• Case: Seventy-Two Hours After the Chatbot Leaked — A retail bank’s GenAI assistant shows one customer another customer’s transactions, the screenshot goes viral before monitoring notices, and the next 72 hours expose every gap the launch review missed.
• Case: The Screening Model Nobody Owned — A candidate complaint unearths a vendor résumé screener that had been auto-rejecting applicants for 18 months — no owner, no audit, no register entry — at a 4,000-person logistics company.
• Case: EU AI Act Readiness at a B2B SaaS Deployer — A US HR-tech vendor spends a year discovering that it is the provider of a high-risk system, that 2 December 2027 is closer than the roadmap assumed, and that its documentation is a product now.
• Case: Twelve Months to a 42001 Certificate at a 900-Person SaaS Firm — An enterprise customer’s procurement demand starts the clock: a gap analysis that shrank 40% to 15%, a scoping fight, four versions of the SoA, a stage 1 near-miss, and two minors at stage 2 — with honest numbers throughout.
• A Multi-Agent Bedrock System, Governed End to End — a Worked Example — One fictional-but-realistic internal ops assistant — supervisor, retrieval agent, ticket-action agent — walked through every governance touchpoint: register, guardrails, tool scoping, logging, evals, oversight, incident path.
• The AI System Register in a Real Control Tower Org — How we keep a live AI inventory across 200+ AWS accounts — and the SCPs, Config rules, and EventBridge automations that keep it honest.
• Running an AI Item Through the Architecture Review Board — What actually changed in our ARB when AI arrived: the addendum, the new quorum seat, the 30-minute agenda, and the anti-patterns we had to unlearn.
• Article 50 Transparency as an Architecture Decision — Each EU AI Act Article 50 duty translated into a place in the stack, a log row, and an owner — chatbot disclosure in UI chrome, C2PA marking that survives the CDN, and an evidence pack that is not screenshots.
• ISO 42001 Annex A on AWS: the Working Mapping — Theme by theme, the AWS primitive that carries each Annex A grouping — and the management-system work no service can sell you.