iTmethods

Three claims your AI vendors are selling. What each actually proves: Air-gapped → isolation. Where the work happened, not whether it was allowed. Never trained on → a policy, until it is a contract term with evidence attached. Does not log → covers the prompt. Not the click. There is no technical guarantee, and this week the industry admitted it. Every one of these moves the boundary. None produces the proof. Sovereignty you cannot audit is not sovereignty. trustlayer.itmethods.com/p/the-sovereig…

Your agents are shipping code. Who is proving it was allowed? The Dark Factory: agents build it, a human approves every merge, Reign proves it. Regulator-ready by default. 15s below → itmethods.com/dark-factory/p…

.@itmethods has joined the Linux Foundation's FINOS and Agentic AI Foundation initiatives to help advance governance standards for agentic AI in regulated industries. See what's driving AI governance 👇 #AI #OpenSource #Governance pureai.com/blogs/the-pure…

Alex Karp gave enterprises five questions for every AI vendor. Who owns the data. Where is it cached. Are the prompts secure. Who controls the weights. Is your alpha transferring. He aimed them at the frontier labs. The worse answers sit further down the SaaS stack, where nobody is asking. Our CEO Paul Goldman in The Trust Layer, with a vendor assessment that grades the answers: trustlayer.itmethods.com/p/the-five-que…

An AI software engineer just hit 492 million dollars in revenue, with Goldman, Citi, and Santander as customers. Gartner says agents will write nearly half of enterprise code this year. The money is going to the coding agents. Almost none is going to the supervisor that governs the floor and proves what they did. Isolation is not governance. The software factory is going dark. In regulated industries, the winners will keep every receipt. The Trust Layer: trustlayer.itmethods.com/p/the-software…

Verifiable proof of trustworthy AI just became an open standard. The Linux Foundation launched the Appia Foundation with Google, Microsoft, OpenAI, Mastercard, and others. The part the agentic era still forces: proof that holds continuously, as agents act and models change. Our CEO Paul Goldman in The Trust Layer: trustlayer.itmethods.com/p/the-new-stan…

1/ Canada is building sovereign AI, and RBC just mapped the stack: models, compute, data centres, research. It is excellent, and one layer is still to build. 2/ No Canadian champion sits on the control and assurance layer above the model, the layer that makes sovereignty operational and provable. Last week's frontier-model recall showed why it is the whole game. 3/ The layer still to build is software, not steel. Our founder Paul Goldman on the one layer Canada should least want to outsource: trustlayer.itmethods.com/p/canadas-sove…

1/ On Friday, the most capable AI model on the public market disappeared. Not throttled. Pulled off every customer on earth by a U.S. export-control order, not a vendor decision. 2/ Not one customer did anything wrong, and the model vanished from all of them anyway. You cannot govern, encrypt, or self-host your way around a model that no longer exists for you to call. 3/ Single-model dependency is a single point of failure. The control layer outranks the model. Our founder Paul Goldman on what the recall means for regulated institutions: trustlayer.itmethods.com/p/three-days-o…

Fascinating time!

This is not a moment for outrage. It is a moment for governance infrastructure. What FINOS CC4AI is. Why it matters. What regulated enterprises should actually do this quarter. itmethods.com/insights/vendo… /end

The FINOS answer is already on the table: CC4AI — Common Controls for AI Services. Backed by BMO, Citi, Microsoft, Morgan Stanley, RBC, Bank of America, Google Cloud, Red Hat, AWS. A common evidence artifact format so vendors attest once and every consuming institution can inherit the assurance.

Yesterday: most AI governance tools were built for the wrong problem. Today: a live industry pattern is making that argument concrete in every regulated enterprise. SaaS vendors are training AI on customer data by default. Thread 👇

5/5 114 days isn't a lot of time to rebuild this from scratch. The enterprises that will make the deadline aren't writing better policies. They're building the infrastructure that makes evidence a byproduct of operation. Full read from @paulgoldman100 → itmethods.com/insights/eu-ai… #AIGovernance #EUAIAct

4/5 What "governance infrastructure" actually means: → Policy-as-code enforcement at the system layer → Audit trails generated automatically, not assembled reactively → Model & agent inventories that stay current on their own → Evidence production ready on demand

1/5 114 days until EU AI Act high-risk enforcement. Most enterprises are still in "policy and spreadsheet" mode. Here's what regulators will actually ask for on August 2, 2026 🧵