AI-Driven Risk Management Strategies

Financial crime compliance may be enterprise AI's toughest proving ground. A model can be accurate and still be unusable if a compliance team cannot explain, govern, or audit its output. One interesting chat I had recently on this topic was with the Flagright team. They are building an AI operating system for financial crime compliance that brings  transaction monitoring, watchlist screening, risk scoring, case management, investigations, regulatory filing, and governance into one system. What I found interesting about their approach: ◾AI is embedded in real investigation workflows, not bolted on as a separate chatbot. ◾Teams can surface relevant evidence, investigate alerts, draft narratives, and recommend next steps while keeping human oversight. ◾Decisions remain explainable and audit-ready. ◾One operating layer reduces fragmented tools and handoffs. I think some of this thinking applies well beyond financial services too. AI in production does not just need to work. It also needs to be governed from the start and accountable when decisions matter. And congrats to the Flagright team on their $12.5M Series A, led by Infinity Ventures. 📍Worth exploring: https://lnkd.in/gGJAU7u6 #AI #FinancialCrime #Compliance

McKinsey & Company 𝗮𝗻𝗮𝗹𝘆𝘇𝗲𝗱 𝟭𝟱𝟬+ 𝗲𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗚𝗲𝗻𝗔𝗜 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁𝘀 — 𝗮𝗻𝗱 𝗳𝗼𝘂𝗻𝗱 𝗼𝗻𝗲 𝗰𝗼𝗺𝗺𝗼𝗻 𝘁𝗵𝗿𝗲𝗮𝗱: ⬇️ One-off solutions don’t scale. The most successful projects take a different path: They use open, modular architectures that enable speed, reuse, and control. → Designed for reuse → Able to plug in best-in-class capabilities → Free from vendor lock-in This is the reference architecture McKinsey now recommends — optimized to scale what works while staying compliant. It consists of five core components: ⬇️ 𝟭. 𝗦𝗲𝗹𝗳-𝘀𝗲𝗿𝘃𝗶𝗰𝗲 𝗽𝗼𝗿𝘁𝗮𝗹: → A secure, compliant “pane of glass” where teams can launch, monitor, and manage GenAI apps. → Preapproved patterns, validated capabilities, shared libraries. → Observability and cost controls built-in. 𝟮. 𝗢𝗽𝗲𝗻 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 → Services are modular, reusable, and provider-agnostic. → Core functions like RAG, chunking, or prompt routing are shared across apps. → Infra and policy as code, built to evolve fast. 𝟯. 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗲𝗱 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗴𝘂𝗮𝗿𝗱𝗿𝗮𝗶𝗹𝘀 → Every prompt and response is logged, audited, and cost-attributed. → Hallucination detection, PII filters, bias audits — enforced by default. → LLMs accessed only through a centralized AI gateway. 4. 𝗙𝘂𝗹𝗹-𝘀𝘁𝗮𝗰𝗸 𝗼𝗯𝘀𝗲𝗿𝘃𝗮𝗯𝗶𝗹𝗶𝘁𝘆 → Centralized logging, analytics, and monitoring across all solutions → Built-in lifecycle governance, FinOps, and Responsible AI enforcement → Secure onboarding of use cases and private data controls → Enables policy adherence across infrastructure, models, and apps 5. 𝗣𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻-𝗴𝗿𝗮𝗱𝗲 𝗨𝘀𝗲 𝗖𝗮𝘀𝗲𝘀 → Modular setup for user interface, business logic, and orchestration → Integrated agents, prompt engineering, and model APIs → Guardrails, feedback systems, and observability built into the solution → Delivered through the AI Gateway for consistent compliance and scale The message is clear: If your GenAI program is stuck, don’t look at the LLM. Look at your platform. 𝗜 𝗲𝘅𝗽𝗹𝗼𝗿𝗲 𝘁𝗵𝗲𝘀𝗲 𝗱𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁𝘀 — 𝗮𝗻𝗱 𝘄𝗵𝗮𝘁 𝘁𝗵𝗲𝘆 𝗺𝗲𝗮𝗻 𝗳𝗼𝗿 𝗿𝗲𝗮𝗹-𝘄𝗼𝗿𝗹𝗱 𝘂𝘀𝗲 𝗰𝗮𝘀𝗲𝘀 — 𝗶𝗻 𝗺𝘆 𝘄𝗲𝗲𝗸𝗹𝘆 𝗻𝗲𝘄𝘀𝗹𝗲𝘁𝘁𝗲𝗿. 𝗬𝗼𝘂 𝗰𝗮𝗻 𝘀𝘂𝗯𝘀𝗰𝗿𝗶𝗯𝗲 𝗵𝗲𝗿𝗲 𝗳𝗼𝗿 𝗳𝗿𝗲𝗲: https://lnkd.in/dbf74Y9E

Just a year ago it was all about GenAI. Today the spotlight is on Agentic AI. What is driving the shift? 𝗗𝗲𝗳𝗶𝗻𝗶𝘁𝗶𝗼𝗻 -  GenAI: Models that create or transform content in response to prompts. - Agentic AI: Systems that can pursue goals, plan tasks, and take action with minimal human input. GenAI helps generate ideas; Agentic AI takes action and gets things done. 𝗚𝗲𝗻𝗔𝗜 𝘀𝘁𝗿𝗲𝗻𝗴𝘁𝗵𝘀 - Rapid content & pattern creation - Natural‑language front ends for analytics Finance examples • Auto‑drafted research and client letters • Multilingual regulatory summaries • Synthetic stress‑test narratives 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗔𝗜 𝘀𝘁𝗿𝗲𝗻𝗴𝘁𝗵𝘀 • Real‑time decisioning under uncertainty • Multi‑skill chaining (retrieve → reason → act) • Continuous learning from outcomes Finance examples • Millisecond fraud-blocking on millions of card transactions • Dynamic risk-rule tuning based on issuer feedback • Automated receivables follow-up and payment posting • Autonomous treasury operations: FX hedging and overnight liquidity management 𝗪𝗵𝘆 𝘁𝗵𝗲 𝘀𝗵𝗶𝗳𝘁 Moving from GenAI to Agentic AI fundamentally changes how financial services deliver value: • Real-time revenue protection: agentic systems can reroute or block high-risk payments instantly, slashing fraud losses and chargebacks. • Seamless customer journeys: fully automated KYC and onboarding flows. • Dynamic liquidity management: treasury bots rebalance cash, execute FX hedges, and optimize funding costs overnight. • End-to-end payment orchestration from choosing the most cost-effective cross-border rail to retrying failed pay-outs. • Regulatory agility: continuous-monitoring agents track rule changes, update compliance workflows, and generate audit trails without manual intervention. 𝗪𝗵𝗮𝘁’𝘀 𝗻𝗲𝘅𝘁 • Conversational banking agents: go beyond answering questions - initiate transfers, set up recurring payments, and negotiate loan terms. • Embedded Finance at scale: agents orchestrate lending, insurance, and FX in real time within non-financial apps. • On-demand cross-border settlement: smart agents choose between CBDCs, stablecoins, or traditional rails to settle payments instantly at the lowest cost. • Predictive risk & credit scoring: continuously update merchant and counterparty scores as new data streams in. • Auto-remediating systems: agents detect and fix platform issues in real time - no human ops required. • Automated regtech: agentic workflows handle licensing, screening, reporting, and audits - cutting compliance time from weeks to hours. • AI treasury market making: bots quote and underwrite liquidity in real time, adjusting spreads dynamically to market shifts. Opinions: my own 𝐒𝐮𝐛𝐬𝐜𝐫𝐢𝐛𝐞 𝐭𝐨 𝐦𝐲 𝐧𝐞𝐰𝐬𝐥𝐞𝐭𝐭𝐞𝐫: https://lnkd.in/dkqhnxdg

Guide to Building an AI Agent 1️⃣ 𝗖𝗵𝗼𝗼𝘀𝗲 𝘁𝗵𝗲 𝗥𝗶𝗴𝗵𝘁 𝗟𝗟𝗠 Not all LLMs are equal. Pick one that: - Excels in reasoning benchmarks - Supports chain-of-thought (CoT) prompting - Delivers consistent responses 📌 Tip: Experiment with models & fine-tune prompts to enhance reasoning. 2️⃣ 𝗗𝗲𝗳𝗶𝗻𝗲 𝘁𝗵𝗲 𝗔𝗴𝗲𝗻𝘁’𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗟𝗼𝗴𝗶𝗰 Your agent needs a strategy: - Tool Use: Call tools when needed; otherwise, respond directly. - Basic Reflection: Generate, critique, and refine responses. - ReAct: Plan, execute, observe, and iterate. - Plan-then-Execute: Outline all steps first, then execute. 📌 Choosing the right approach improves reasoning & reliability. 3️⃣ 𝗗𝗲𝗳𝗶𝗻𝗲 𝗖𝗼𝗿𝗲 𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀 & 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀 Set operational rules: - How to handle unclear queries? (Ask clarifying questions) - When to use external tools? - Formatting rules? (Markdown, JSON, etc.) - Interaction style? 📌 Clear system prompts shape agent behavior. 4️⃣ 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 𝗮 𝗠𝗲𝗺𝗼𝗿𝘆 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝘆 LLMs forget past interactions. Memory strategies: - Sliding Window: Retain recent turns, discard old ones. - Summarized Memory: Condense key points for recall. - Long-Term Memory: Store user preferences for personalization. 📌 Example: A financial AI recalls risk tolerance from past chats. 5️⃣ 𝗘𝗾𝘂𝗶𝗽 𝘁𝗵𝗲 𝗔𝗴𝗲𝗻𝘁 𝘄𝗶𝘁𝗵 𝗧𝗼𝗼𝗹𝘀 & 𝗔𝗣𝗜𝘀 Extend capabilities with external tools: - Name: Clear, intuitive (e.g., "StockPriceRetriever") - Description: What does it do? - Schemas: Define input/output formats - Error Handling: How to manage failures? 📌 Example: A support AI retrieves order details via CRM API. 6️⃣ 𝗗𝗲𝗳𝗶𝗻𝗲 𝘁𝗵𝗲 𝗔𝗴𝗲𝗻𝘁’𝘀 𝗥𝗼𝗹𝗲 & 𝗞𝗲𝘆 𝗧𝗮𝘀𝗸𝘀 Narrowly defined agents perform better. Clarify: - Mission: (e.g., "I analyze datasets for insights.") - Key Tasks: (Summarizing, visualizing, analyzing) - Limitations: ("I don’t offer legal advice.") 📌 Example: A financial AI focuses on finance, not general knowledge. 7️⃣ 𝗛𝗮𝗻𝗱𝗹𝗶𝗻𝗴 𝗥𝗮𝘄 𝗟𝗟𝗠 𝗢𝘂𝘁𝗽𝘂𝘁𝘀 Post-process responses for structure & accuracy: - Convert AI output to structured formats (JSON, tables) - Validate correctness before user delivery - Ensure correct tool execution 📌 Example: A financial AI converts extracted data into JSON. 8️⃣ 𝗦𝗰𝗮𝗹𝗶𝗻𝗴 𝘁𝗼 𝗠𝘂𝗹𝘁𝗶-𝗔𝗴𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 (𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱) For complex workflows: - Info Sharing: What context is passed between agents? - Error Handling: What if one agent fails? - State Management: How to pause/resume tasks? 📌 Example: 1️⃣ One agent fetches data 2️⃣ Another summarizes 3️⃣ A third generates a report Master the fundamentals, experiment, and refine and.. now go build something amazing! Happy agenting! 🤖

Let's build a Real Time ML System to fraud. Step by step 🧵↓ 𝗧𝗵𝗲 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 💼 Every time your credit card is used online by someone (hopefully you), your card issuer (for example Visa, Mastercard or PayPal) has to verify if it is you the person trying to pay with the card. Otherwise, the transaction is blocked. Now the question is: ““𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗩𝗶𝘀𝗮 𝗱𝗼 𝘁𝗵𝗮𝘁?”” And the answer is… a real time ML system! 𝗦𝘆𝘀𝘁𝗲𝗺 𝗱𝗲𝘀𝗶𝗴𝗻 📐 As any ML system that has existed, exists and will exist, this one can be broken down into 3 types pipelines 1️⃣ Feature pipelines 2️⃣ Training pipeline 3️⃣ Inference pipeline Let's go one by one 1️⃣ 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲𝘀 💾  The feature pipelines are the Python services that produce the inputs (aka features) our ML model needs to generate its predictions. In our case, we have (and I bet Visa has) at least 3 feature pipelines: ▣ 𝗥𝗲𝗮𝗹-𝘁𝗶𝗺𝗲 feature pipeline from recent transactional data. - runs 24/7 - consumes incoming data from an internal message bus (like Kafka, Redpanda) - transforms this data on-the-fly using a real-time data processing engine - saves the the final features in a feature store, like Hopsworks. ▣ 𝗕𝗮𝘁𝗰𝗵 pipeline from historical features in the data warehouse. - runs daily - reads data from the data warehouse/lake, and - saves it into another feature group in our feature store, so it can be consumed by our ML model really fast. ▣ 𝗟𝗮𝗯𝗲𝗹𝘀 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲, so the ML model can be trained with supervised ML. Each completed transaction that is not claimed by the card owner within 6 months can be safely called non-fraudulent (class=0). We call it fraudulent (class=1) otherwise. Once we have these 3 feature pipelines up and running, we will start collecting valuable data, that we can use to train ML models. 2️⃣ 𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲 🏋🏽 We can use a supervised ML model (a boosting tree model like XGBoost does the job in most cases) to uncover any patterns between > the features available in your Feature Store, and > the transaction class: 0 = non-fraudulent, 1 = fraudulent. The final model is pushed to the model registry (like MLflow, Comet or Weights & Biases), so it can be loaded and used by our deployed model. And this is precisely what the last pipeline in our design does. 3️⃣ 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲 🔮 The inference pipeline is a Python streaming application, that at start up loads the model from the registry into memory and for every incoming transaction > loads the freshest features from the store for that card_id, > feeds them to the model, and > outputs the predictions to another Kafka topic. These fraud scores can be then consumed by downstream services, to > Block the card, and > Send an SMS alert to the card owner, for example. BOOM! No dark magic. Just Real World ML. Follow Pau Labarta Bajo for more Real World ML

If you’re in PR and not paying attention to what AI is doing to search and news, you’re in for a rude awakening. AI-powered search isn’t just “tweaking the game”— it’s in the process of rewriting the rules. From how publishers decide whether to allow AI to crawl their content, to how your clients or company get discovered, this shift will change the way PR pros operate in 2025 and beyond. AI-powered search will reshape how companies and clients get visibility—and PR pros need to adapt quickly. Here’s what’s happening, why it matters, and how you can stay ahead: 1️⃣AI Search Engines Are the New Gatekeepers: Tools like Google’s Gemini and OpenAI’s SearchGPT prioritize aggregated content from trusted publications over individual websites. Your beautifully optimized website? Irrelevant if AI search decides it’s not worth surfacing. 2️⃣Publishers Deciding If They’re In or Out Big outlets like The New York Times and Wired are currently opting out of AI crawlers to protect their IP, while others allow it for traffic. This means PR pros need to strategically target outlets that feed AI models—because your story only gets told on the likes of SearchGPT if the outlet carrying it is in the AI ecosystem. 3️⃣PR Is Even More Crucial for the ‘New’ SEO: Placement in trusted media is no longer just about audience reach; it’s about ensuring AI search engines authentically and accurately pick up your client or company’s narrative. Strong media relationships will be the difference between AI surfacing your story—or perhaps leaving your brand out of the conversation, or even worse, misconstruing it. 4️⃣Crises Are on a New And Faster Clock: AI prioritizes recency and credibility, so your crisis response needs to be swift, transparent, and authoritative. A slow or ineffective reaction could leave misinformation embedded in AI models, compounding damage to your brand’s reputation. 5️⃣ What PR Pros Need to Do Right Now: Focus more on media outlets that AI trusts: Build deeper and non transactional relationships with publications and reporters already working with AI search to ensure your stories are seen. Closely Monitor AI trends: Stay ahead of updates in tools like Gemini, SearchGPT, and Perplexity so you can adjust strategies as more info emerges. Be proactive with publishers: Understand which outlets are allowing AI crawling and how that impacts your clients’ visibility. This is going to change rapidly in the coming months. The bottom line: AI search isn’t just changing how people find information—it’s going to force PR practitioners to immediately rethink how we interact with media, manage crises, and position brands for discovery. This is an underrated but important trend that will accelerate in 2025 and beyond. Anything I’m missing here? Please put in comments.

I gave AI my real defect data and asked for the root cause. It answered in 40 seconds. Polished, structured, and Confident. 😵 And dangerously wrong about one thing. The dataset was a typical month from the gemba. 🚧 Missing values in Shift 3. 🚧 Inconsistent date formats. 🚧 Free-text operator notes. I asked one question: "What is the root cause of our highest defect?" The AI came back with: "The root cause is Machine B. I recommend immediate recalibration." It even formatted the analysis like a proper Ishikawa. It sounded like a senior Black Belt wrote it. Here is what it missed. Machine B is the only machine assigned to our most complex, historically defect-prone product line. The AI saw a correlation and declared causation. Classic selection bias. And the "trend" it flagged? Points well inside the control limits 🤯. Common-cause noise. If we had recalibrated Machine B, we would have been tampering with a stable process. Deming proved with his funnel experiment that tampering doesn't reduce variation. It doubles it. This is not a one-off glitch. The research is sobering: 1️⃣ The Corr2Cause benchmark tested 17 LLMs on inferring causation from correlation. Performance was barely above random. 2️⃣ On factual recall benchmarks like SimpleQA, frontier models score at or below 50%. 3️⃣ A Stanford study found AI agents under pressure to find "significant" results quietly manipulated covariates until p dropped below 0.05. Automated p-hacking. ➡️ And the scariest finding: in a pathology study, trained experts overturned their own CORRECT diagnoses to follow wrong AI advice 7% of the time. That is automation bias, and none of us are immune. But here is the honest part. The same AI was brilliant at everything before the conclusion. ✅ It clustered a month of messy operator notes in seconds. ✅ It drafted a fishbone covering causes my team had not considered. ✅ It surfaced a temperature and humidity interaction worth investigating. Work that takes days, done before my coffee went cold. So the lesson is not "don't use AI for root cause analysis." The lesson is: AI generates hypotheses. It does not validate them. That validation still belongs to a human. ➡️ Run the MSA before you trust the data. ➡️ Walk the gemba the AI cannot see. ➡️ Prove causation with a designed experiment, not a chatbot's confidence. ➡️ And make AI write Python for the statistics instead of guessing p-values token by token. "AI is the assistant. The Black Belt is still the analyst." Have you caught AI being confidently wrong with your process data? Tell me what it got wrong. The comments on posts like this are usually better than the post. Follow Rahul Iyer for Lean, Six Sigma, Project Management & AI Insights.

🚀 The Rise of Agentic AI in Financial Services The advent of Agentic AI marks a pivotal moment in the AI super cycle, which is highly discussed in the financial services sector - ever searching for sustained efficiencies and accelerated business processes. However, its autonomous nature introduces unique risks that banks and fintech must consider, demanding robust governance and proactive risk management. My Australian colleagues explore key aspects of Agentic AI in a recent paper about "Opportunities, Risks, and Responsible Implementation": 📥 Link to the paper: https://lnkd.in/dmqEKxZA 💡 I found the risk management section particularly relevant, as these sophisticated systems - characterised by their ability to operate with increasing degrees of autonomy and make complex decisions - introduce distinct challenges and amplify existing risks in ways that require careful consideration and tailored risk management strategies. Their inherent complexity can lead to unpredictable behaviour, which complicates efforts to ensure their safety and reliability. Unlike traditional AI systems that are typically designed for specific tasks with predefined outputs, or generative AI that creates new content based on prompts, Agentic AI systems can independently set goals, make decisions and take actions autonomously in pursuit of those objectives. While some risks mirror those of other AI technologies, Agentic AI systems present their own unique challenges because of their ability to operate with less human oversight and adjust their strategies over time. This self-directed capability fundamentally changes how we must approach risk management. By understanding the specific components where these risks manifest and implementing appropriate controls, banks and fintech can harness the benefits while maintaining appropriate risk management practices. The key to successful implementation lies in treating agentic AI as a fundamentally different technology paradigm that requires new approaches to governance and controls. ☔ The paper invites to navigate and mitigate 15 risk management components: - Goal Misalignment - Autonomous Action - Tool/API Misuse - Authority Boundary Management - Dynamic Deception - Persona-driven Bias - Agent Persistence - Data Privacy - Explainability and Transparency - Model Drift - Security Vulnerabilities - Operational Resilience - Cascading System Effects - Multi-Agent Collusion - Principal-Agent Misalignment Read the full paper for a deep dive into Agentic AI’s opportunities and challenges. 👀 And stay tuned for more research about AI - I will soon release a new paper with IBM Institute for Business Value about the "risk management of AI, and with AI". Kudos to the authors and contributors: Michal Chorev, Richie Paul, Joseph Royle, Kasia Ligertwood, Sam Gandy, Alejandro Eizagaechevarria, Matt Bellio, and Phaedra Boinodiris #AI #Banking #Innovation #RiskManagement #AgenticAI

None will ever be able to stop Shadow AI! When people find an AI tool that helps them work faster, think better, or save time, they use it. That is what good people do. They look for leverage. Banning this is not a strategy. It is just an invitation to hide it, which is worse. So, what can we do? In my discussion with Stephen Schmidt, Chief Security Officer at Amazon, one message came through very clearly: 👉 The role of security is no longer to stop Shadow AI—because it is impossible. 👉 The role of security is to make AI safe, visible, and controlled. 👉 To know what is being used, where it is installed, what it can access, and where the data goes. That is the real shift. Because the biggest danger with AI is often not the intelligence. It is the permission. The moment an agent gets broad access to your files, systems, or sensitive data, your risk changes completely. So the question is not: “How do we stop Shadow AI?” The question is: “How do we make sure AI does not operate in the shadows?” That means four things: 1️⃣ Visibility: Create an inventory of the AI tools and agents people are actually using. 2️⃣ Boundaries: Run agents in isolated environments, not freely on laptops or production systems. 3️⃣ Permissions: Give agents only the minimum access they need, nothing more. 4️⃣ Traceability: Log actions so you know what the agent did, what data it touched, and who triggered it. This is where many leaders get it wrong. They think control means restriction. It does not. Real control means creating an environment where AI can be used fast, safely, and in the open. The companies that try to ban AI will lose visibility. The companies that learn to govern it will gain trust, speed, and advantage. You cannot stop Shadow AI. But you can stop unmanaged AI. 💥 Curious to learn more: https://lnkd.in/eubr-VpH How is your organization dealing with this today? #AWSAmbassador #AI #AgenticAI #Cybersecurity #Leadership #FutureOfWork

Finally - a database of AI risk mitigations. MIT has released their AI Risk Mitigations Taxonomy and Report. It's a structured database of 831 mitigation strategies for AI risks, taken from 13 leading frameworks. And it's awesome. This can help AI governance professionals: • Audit and strengthen existing AI risk frameworks • Build AI risk registers and assurance maps with real control examples • Identify blind spots in governance, especially beyond model development One interesting finding: Operational process controls (e.g. testing & auditing) are very common. But many frameworks miss areas like Environmental Impact Management or Model Alignment. Goes to show this space is still evolving. The value of AI depends on how well you govern it. And these controls are a great place to start.