CompoundTrust

AI Security Readiness Kit

Season 2 · The First 90 Days. One-page tools, free to print and use.

• Day 1 AI inventory: which AI uses deserve attention first Six fields to record for each AI use, five places to find them, and three stated criteria for what to review first. Find · Record · Prioritise
• Day 15 AI acceptable use: five rules on one page Clear operating boundaries for the people already using AI at work, and a route for exceptions. Rules · Exceptions · Measures

Field notes

• Episode 6 The EU AI Act: five questions, not a list of articles The high-risk deadline moved to December 2027. The obligation did not disappear — and the same amendment brought a new prohibition forward to December 2026. Role · Risk class · Timetable · Evidence
• Episode 7 The lethal trifecta Three capabilities that are harmless alone and dangerous together — and the three places I keep finding all three switched on at once. Prompt · SaaS features · Patch automation

Crosswalks

Reference pages. Maintained and versioned, not published once and left.

• Reference Three AI deployments, three regulatory roles What controls, what framework, what you tell the customer — worked through three real architectures. The answers diverge on where you sit in the supply chain, not on the technology. Deployer · Deployer · Provider

Elsewhere

The same material, narrated, on the CompoundTrust channel, and in short form on LinkedIn.