[{"data":1,"prerenderedAt":126},["ShallowReactive",2],{"blog-tag-evidence":3},[4,24,37,50,61,71,84,95,104,115],{"id":5,"slug":6,"body":7,"html":8,"title":9,"description":10,"category":11,"tags":12,"author":17,"date":18,"year":19,"month":20,"quarter":21,"status":22,"featured":23},"2026\u002F09\u002Fdigital-assets\u002Foperator-control-plane-for-virtual-asset-businesses","operator-control-plane-for-virtual-asset-businesses","\nA licensed virtual-asset operator typically runs a dozen specialised systems: custody and wallets, KYC and KYB, blockchain analytics, Travel Rule, the exchange or payment platform, banking rails, ticketing, CRM and reporting. Each one works. The **operation** across them often doesn't. It lives in spreadsheets, email, chat and vendor portals.\n\nThe **Virtual Asset Operator Control Plane** family is the application layer across that stack.\n\n## What it does\n\n- **Work queues:** every operational task (a withdrawal review, an onboarding exception, an address approval) becomes a work item with an owner and a service level.\n- **Maker\u002Fchecker:** sensitive actions require a second person, enforced by the application rather than a policy PDF.\n- **Approval routing:** approvals route by amount, asset, counterparty, risk score or client segment.\n- **Case ownership and workflow state:** everyone can see where every item is and who holds it.\n- **Exception management:** breaks and failures go to a register with ageing and escalation.\n- **Reconciliation:** balances and movements are compared across custody, platform and banking records.\n- **Control evidence:** every decision produces an audit event, and evidence packs are generated from the record.\n- **Management dashboards:** operational SLAs, backlogs, exceptions and control health.\n\n## Where AI helps\n\n- **Case summarization:** transaction context, screening results and history in a few lines.\n- **Exception prioritization:** the queue ordered by risk and urgency.\n- **Operational search:** find every item involving a given client, address or counterparty.\n- **Evidence-pack drafting:** assembled from records, reviewed by a person.\n\nEvery consequential action stays with named people. AI never approves a transfer.\n\n## What it does not replace\n\nYour licensed infrastructure and your accountability. Custody stays with the custodian, keys stay where they are, and screening stays with your chosen providers. The control plane orchestrates how your people operate those systems.\n\n## Integrations\n\nCustody and wallet platforms, KYC\u002FKYB and KYT providers, Travel Rule solutions, the core exchange or payment platform, banking and payment rails, ticketing, CRM and the data warehouse.\n\n## Who buys it\n\nCOOs, CCOs, Heads of Operations, Heads of Digital Assets and Heads of Platform Operations at licensed VASPs, exchanges, custodians and payment-token operators.\n\n## First scope\n\nThe one workflow that creates the most risk. It is usually onboarding → first transfer, or withdrawals above a threshold. See [licence is not production](\u002Fblog\u002Flicence-is-not-production) and [dual control that survives Tuesday](\u002Fblog\u002Fdual-control-that-survives-tuesday).\n\nExplore [digital asset applications](\u002Findustries\u002Fdigital-assets) or [bring us the workflow](\u002Fcontact).\n\n*fazeZERO builds and integrates applications. We do not hold keys or custody assets, provide investment or legal advice, file licences, or guarantee regulatory outcomes.*\n","\u003Cp>A licensed virtual-asset operator typically runs a dozen specialised systems: custody and wallets, KYC and KYB, blockchain analytics, Travel Rule, the exchange or payment platform, banking rails, ticketing, CRM and reporting. Each one works. The \u003Cstrong>operation\u003C\u002Fstrong> across them often doesn't. It lives in spreadsheets, email, chat and vendor portals.\u003C\u002Fp>\n\u003Cp>The \u003Cstrong>Virtual Asset Operator Control Plane\u003C\u002Fstrong> family is the application layer across that stack.\u003C\u002Fp>\n\u003Ch2>What it does\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Work queues:\u003C\u002Fstrong> every operational task (a withdrawal review, an onboarding exception, an address approval) becomes a work item with an owner and a service level.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Maker\u002Fchecker:\u003C\u002Fstrong> sensitive actions require a second person, enforced by the application rather than a policy PDF.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Approval routing:\u003C\u002Fstrong> approvals route by amount, asset, counterparty, risk score or client segment.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Case ownership and workflow state:\u003C\u002Fstrong> everyone can see where every item is and who holds it.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Exception management:\u003C\u002Fstrong> breaks and failures go to a register with ageing and escalation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reconciliation:\u003C\u002Fstrong> balances and movements are compared across custody, platform and banking records.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Control evidence:\u003C\u002Fstrong> every decision produces an audit event, and evidence packs are generated from the record.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Management dashboards:\u003C\u002Fstrong> operational SLAs, backlogs, exceptions and control health.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Case summarization:\u003C\u002Fstrong> transaction context, screening results and history in a few lines.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Exception prioritization:\u003C\u002Fstrong> the queue ordered by risk and urgency.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Operational search:\u003C\u002Fstrong> find every item involving a given client, address or counterparty.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence-pack drafting:\u003C\u002Fstrong> assembled from records, reviewed by a person.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Every consequential action stays with named people. AI never approves a transfer.\u003C\u002Fp>\n\u003Ch2>What it does not replace\u003C\u002Fh2>\n\u003Cp>Your licensed infrastructure and your accountability. Custody stays with the custodian, keys stay where they are, and screening stays with your chosen providers. The control plane orchestrates how your people operate those systems.\u003C\u002Fp>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>Custody and wallet platforms, KYC\u002FKYB and KYT providers, Travel Rule solutions, the core exchange or payment platform, banking and payment rails, ticketing, CRM and the data warehouse.\u003C\u002Fp>\n\u003Ch2>Who buys it\u003C\u002Fh2>\n\u003Cp>COOs, CCOs, Heads of Operations, Heads of Digital Assets and Heads of Platform Operations at licensed VASPs, exchanges, custodians and payment-token operators.\u003C\u002Fp>\n\u003Ch2>First scope\u003C\u002Fh2>\n\u003Cp>The one workflow that creates the most risk. It is usually onboarding → first transfer, or withdrawals above a threshold. See \u003Ca href=\"\u002Fblog\u002Flicence-is-not-production\">licence is not production\u003C\u002Fa> and \u003Ca href=\"\u002Fblog\u002Fdual-control-that-survives-tuesday\">dual control that survives Tuesday\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Explore \u003Ca href=\"\u002Findustries\u002Fdigital-assets\">digital asset applications\u003C\u002Fa> or \u003Ca href=\"\u002Fcontact\">bring us the workflow\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Cem>fazeZERO builds and integrates applications. We do not hold keys or custody assets, provide investment or legal advice, file licences, or guarantee regulatory outcomes.\u003C\u002Fem>\u003C\u002Fp>\n","An operator control plane for licensed virtual-asset businesses","One operating application across custody, compliance, payments and ticketing: queues, maker\u002Fchecker, exceptions and evidence, with no rip-and-replace.","digital-assets",[11,13,14,15,16],"operations","evidence","governance","custody","fazezero-editorial","2026-09-17T00:00:00.000Z",2026,9,3,"published",false,{"id":25,"slug":26,"body":27,"html":28,"title":29,"description":30,"category":31,"tags":32,"author":17,"date":36,"year":19,"month":20,"quarter":21,"status":22,"featured":23},"2026\u002F09\u002Findustry-applications\u002Fquality-and-non-conformance-management","quality-and-non-conformance-management","\nEvery manufacturer has a quality system on paper. Many still run parts of it in spreadsheets and email: non-conformance reports typed up after the shift, CAPA actions tracked in a workbook, supplier issues buried in threads, audit evidence gathered before each certification visit.\n\nThe consequence isn't just inefficiency. When quality data is fragmented, recurring problems stay invisible until a customer finds them.\n\n## What the application does\n\nThe **quality management** family in the Atlas connects the core quality workflows:\n\n- **Non-conformance reporting:** captured at the point of detection, on the shop floor or at incoming inspection, with photos, measurements and lot or batch references.\n- **Containment:** holds on affected lots, quarantined stock and notifications to downstream processes.\n- **Disposition:** use-as-is, rework, scrap or return to supplier, approved by the right roles.\n- **Root cause and CAPA:** structured analysis (5 Whys, fishbone), corrective and preventive actions with owners, dates and effectiveness checks.\n- **Inspections:** plans, checklists and results tied to parts, processes and suppliers.\n- **Traceability:** links between lots, materials, equipment, operators and non-conformances.\n- **Audit readiness:** evidence of control operation for ISO and customer audits.\n\n## Where AI helps\n\n- **Classification:** suggest the defect code, affected process and severity from free-text reports and photos.\n- **Similar-issue retrieval:** “has this happened before?” answered with links to past non-conformances and their root causes.\n- **Root-cause support:** propose candidate causes from correlated data (the same machine, shift, supplier lot or tooling) for engineers to test.\n- **Document intelligence:** extract data from supplier certificates and inspection reports.\n- **Summaries:** quality review packs drafted from the record.\n\nA quality engineer decides the root cause and the disposition. The AI shortens the search, not the judgement.\n\n## Controls designed in\n\n- Mandatory containment steps before disposition\n- Role-based approval for use-as-is decisions\n- Effectiveness verification before a CAPA can close\n- Full lot-level traceability and an audit trail\n\n## Integrations\n\nMES and SCADA or historians for process data, ERP for materials and lots, LIMS for lab results, PLM for specifications, supplier portals, and the identity provider for shop-floor access.\n\n## Who uses it\n\nQuality engineers and inspectors, production supervisors, supplier quality teams, plant managers, and auditors.\n\n## First scope\n\nOne product line or plant, with non-conformance reporting and CAPA moved into the application. Measure time to containment, recurrence rate and CAPA on-time closure. Scope it in a [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint).\n\nSee [industrial and manufacturing](\u002Findustries\u002Findustrial-manufacturing), explore the [Atlas](\u002Fatlas), or [bring us your NCR backlog](\u002Fcontact).\n","\u003Cp>Every manufacturer has a quality system on paper. Many still run parts of it in spreadsheets and email: non-conformance reports typed up after the shift, CAPA actions tracked in a workbook, supplier issues buried in threads, audit evidence gathered before each certification visit.\u003C\u002Fp>\n\u003Cp>The consequence isn't just inefficiency. When quality data is fragmented, recurring problems stay invisible until a customer finds them.\u003C\u002Fp>\n\u003Ch2>What the application does\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>quality management\u003C\u002Fstrong> family in the Atlas connects the core quality workflows:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Non-conformance reporting:\u003C\u002Fstrong> captured at the point of detection, on the shop floor or at incoming inspection, with photos, measurements and lot or batch references.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Containment:\u003C\u002Fstrong> holds on affected lots, quarantined stock and notifications to downstream processes.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Disposition:\u003C\u002Fstrong> use-as-is, rework, scrap or return to supplier, approved by the right roles.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Root cause and CAPA:\u003C\u002Fstrong> structured analysis (5 Whys, fishbone), corrective and preventive actions with owners, dates and effectiveness checks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Inspections:\u003C\u002Fstrong> plans, checklists and results tied to parts, processes and suppliers.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Traceability:\u003C\u002Fstrong> links between lots, materials, equipment, operators and non-conformances.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Audit readiness:\u003C\u002Fstrong> evidence of control operation for ISO and customer audits.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Classification:\u003C\u002Fstrong> suggest the defect code, affected process and severity from free-text reports and photos.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Similar-issue retrieval:\u003C\u002Fstrong> “has this happened before?” answered with links to past non-conformances and their root causes.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Root-cause support:\u003C\u002Fstrong> propose candidate causes from correlated data (the same machine, shift, supplier lot or tooling) for engineers to test.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Document intelligence:\u003C\u002Fstrong> extract data from supplier certificates and inspection reports.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Summaries:\u003C\u002Fstrong> quality review packs drafted from the record.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>A quality engineer decides the root cause and the disposition. The AI shortens the search, not the judgement.\u003C\u002Fp>\n\u003Ch2>Controls designed in\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Mandatory containment steps before disposition\u003C\u002Fli>\n\u003Cli>Role-based approval for use-as-is decisions\u003C\u002Fli>\n\u003Cli>Effectiveness verification before a CAPA can close\u003C\u002Fli>\n\u003Cli>Full lot-level traceability and an audit trail\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>MES and SCADA or historians for process data, ERP for materials and lots, LIMS for lab results, PLM for specifications, supplier portals, and the identity provider for shop-floor access.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>Quality engineers and inspectors, production supervisors, supplier quality teams, plant managers, and auditors.\u003C\u002Fp>\n\u003Ch2>First scope\u003C\u002Fh2>\n\u003Cp>One product line or plant, with non-conformance reporting and CAPA moved into the application. Measure time to containment, recurrence rate and CAPA on-time closure. Scope it in a \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>See \u003Ca href=\"\u002Findustries\u002Findustrial-manufacturing\">industrial and manufacturing\u003C\u002Fa>, explore the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your NCR backlog\u003C\u002Fa>.\u003C\u002Fp>\n","Quality and non-conformance management with AI-assisted root cause","Manufacturing quality applications for non-conformances, CAPA, inspections and traceability, where AI helps engineers find patterns faster.","industry-applications",[33,34,35,14],"manufacturing","quality","document-intelligence","2026-09-10T00:00:00.000Z",{"id":38,"slug":39,"body":40,"html":41,"title":42,"description":43,"category":31,"tags":44,"author":17,"date":48,"year":19,"month":49,"quarter":21,"status":22,"featured":23},"2026\u002F08\u002Findustry-applications\u002Fthird-party-and-supplier-risk-reviews","third-party-and-supplier-risk-reviews","\nMost organizations depend on hundreds or thousands of third parties: cloud providers, outsourcers, suppliers, data processors, agents, fintech partners. Regulators increasingly hold the organization accountable for those dependencies. Yet third-party risk management often runs on questionnaires sent by email, answers pasted into spreadsheets, and reviews that happen at onboarding and then never again.\n\n## What the application does\n\nThe **third-party risk** family in the Atlas manages the full supplier risk lifecycle:\n\n1. **Intake:** a business owner requests a new third party, with the service description, data access and criticality.\n2. **Tiering:** inherent risk is scored from the service, data, criticality and jurisdiction, which determines the depth of due diligence.\n3. **Due diligence:** questionnaires, document requests (certifications, audit reports, policies) and specialist reviews such as security, privacy, financial and legal.\n4. **Assessment:** reviewers record findings, and issues get remediation actions.\n5. **Approval:** a risk-based approval with conditions.\n6. **Contracting:** required clauses confirmed, then onboarding.\n7. **Ongoing monitoring:** periodic re-reviews, certificate expiry, incidents, performance and external signals.\n8. **Exit planning:** for critical services, as regulators now expect.\n\n## Where AI helps\n\n- **Document intelligence:** extract scope, dates, exceptions and qualified opinions from SOC reports, ISO certificates and policies. This is where reviewers spend most of their time.\n- **Questionnaire analysis:** flag answers that contradict the evidence or are incomplete.\n- **Tiering suggestions:** propose a tier from the intake description, for the risk owner to confirm.\n- **Monitoring summaries:** condense external news and incident signals about a supplier into a short brief, with sources.\n- **Report drafting:** assessment summaries and committee papers.\n\nRisk acceptance, approval and exit decisions stay with accountable owners.\n\n## Controls designed in\n\n- Mandatory due-diligence steps by tier\n- Segregation between the requesting business owner and the approving risk function\n- Evidence retained against each finding\n- Re-review triggers on expiry, incidents or changes in service scope\n\n## Integrations\n\nProcurement and contract management systems, ERP vendor master data, GRC tools, security rating or intelligence feeds where used, the identity provider, and email for supplier correspondence.\n\n## Who uses it\n\nProcurement managers, third-party risk teams, security and privacy reviewers, compliance officers, business owners of each relationship, and internal audit.\n\n## Where it applies\n\nFinancial services, where outsourcing and operational-resilience rules apply. Government entities managing contractors. Any enterprise with significant data processors or critical suppliers.\n\n## First scope\n\nCritical and high-tier suppliers first: move them into the application with evidence extracted from their latest reports, and switch on monitoring. Scope it in a [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint).\n\nExplore the [Atlas](\u002Fatlas), or [bring us your supplier inventory](\u002Fcontact).\n","\u003Cp>Most organizations depend on hundreds or thousands of third parties: cloud providers, outsourcers, suppliers, data processors, agents, fintech partners. Regulators increasingly hold the organization accountable for those dependencies. Yet third-party risk management often runs on questionnaires sent by email, answers pasted into spreadsheets, and reviews that happen at onboarding and then never again.\u003C\u002Fp>\n\u003Ch2>What the application does\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>third-party risk\u003C\u002Fstrong> family in the Atlas manages the full supplier risk lifecycle:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Intake:\u003C\u002Fstrong> a business owner requests a new third party, with the service description, data access and criticality.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tiering:\u003C\u002Fstrong> inherent risk is scored from the service, data, criticality and jurisdiction, which determines the depth of due diligence.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Due diligence:\u003C\u002Fstrong> questionnaires, document requests (certifications, audit reports, policies) and specialist reviews such as security, privacy, financial and legal.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Assessment:\u003C\u002Fstrong> reviewers record findings, and issues get remediation actions.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Approval:\u003C\u002Fstrong> a risk-based approval with conditions.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Contracting:\u003C\u002Fstrong> required clauses confirmed, then onboarding.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ongoing monitoring:\u003C\u002Fstrong> periodic re-reviews, certificate expiry, incidents, performance and external signals.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Exit planning:\u003C\u002Fstrong> for critical services, as regulators now expect.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Document intelligence:\u003C\u002Fstrong> extract scope, dates, exceptions and qualified opinions from SOC reports, ISO certificates and policies. This is where reviewers spend most of their time.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Questionnaire analysis:\u003C\u002Fstrong> flag answers that contradict the evidence or are incomplete.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tiering suggestions:\u003C\u002Fstrong> propose a tier from the intake description, for the risk owner to confirm.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Monitoring summaries:\u003C\u002Fstrong> condense external news and incident signals about a supplier into a short brief, with sources.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Report drafting:\u003C\u002Fstrong> assessment summaries and committee papers.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Risk acceptance, approval and exit decisions stay with accountable owners.\u003C\u002Fp>\n\u003Ch2>Controls designed in\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Mandatory due-diligence steps by tier\u003C\u002Fli>\n\u003Cli>Segregation between the requesting business owner and the approving risk function\u003C\u002Fli>\n\u003Cli>Evidence retained against each finding\u003C\u002Fli>\n\u003Cli>Re-review triggers on expiry, incidents or changes in service scope\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>Procurement and contract management systems, ERP vendor master data, GRC tools, security rating or intelligence feeds where used, the identity provider, and email for supplier correspondence.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>Procurement managers, third-party risk teams, security and privacy reviewers, compliance officers, business owners of each relationship, and internal audit.\u003C\u002Fp>\n\u003Ch2>Where it applies\u003C\u002Fh2>\n\u003Cp>Financial services, where outsourcing and operational-resilience rules apply. Government entities managing contractors. Any enterprise with significant data processors or critical suppliers.\u003C\u002Fp>\n\u003Ch2>First scope\u003C\u002Fh2>\n\u003Cp>Critical and high-tier suppliers first: move them into the application with evidence extracted from their latest reports, and switch on monitoring. Scope it in a \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Explore the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your supplier inventory\u003C\u002Fa>.\u003C\u002Fp>\n","Third-party and supplier risk reviews that keep up with the supplier base","Third-party risk applications that tier suppliers, run due diligence, extract evidence from documents and track issues, with reviewers deciding.",[45,46,47,35,14],"risk","enterprise-operations","financial-services","2026-08-18T00:00:00.000Z",8,{"id":51,"slug":52,"body":53,"html":54,"title":55,"description":56,"category":31,"tags":57,"author":17,"date":60,"year":19,"month":49,"quarter":21,"status":22,"featured":23},"2026\u002F08\u002Findustry-applications\u002Ffield-service-for-utilities","field-service-for-utilities","\nUtilities run on field work: inspections, maintenance, connections, fault repairs, meter work and emergency response. The field crews are skilled. The coordination around them often isn't. Work orders come out of the EAM system, get printed or messaged, and are completed on paper or in a spreadsheet. Evidence of what was done, and whether it was done safely, arrives late or incomplete.\n\n## What the application does\n\nThe **field service** family in the Atlas covers the full job lifecycle:\n\n1. **Work intake:** planned maintenance, customer requests and faults arrive as work orders from EAM, CRM or outage systems.\n2. **Planning:** jobs are grouped, sequenced and matched to crew skills, certifications, equipment and permits.\n3. **Dispatch:** assignment to crews, with changes pushed to mobile devices.\n4. **Job packs:** asset history, drawings, procedures and safety requirements, available offline.\n5. **Execution:** mobile checklists, readings, photos and materials used, captured as structured data.\n6. **Safety checkpoints:** permit-to-work, isolation confirmations and hazard assessments as mandatory steps.\n7. **Completion and evidence:** sign-off, updates back to the asset record and customer notification.\n8. **Reporting:** productivity, first-time fix, backlog and compliance.\n\n## Where AI helps\n\n- **Scheduling and dispatch optimization:** suggest crew assignments and routes, while supervisors keep the final say.\n- **Job-pack assembly:** retrieve the relevant procedures, asset history and past defect notes for this asset.\n- **Photo and document intelligence:** check that required photos and readings are present and legible before a job closes.\n- **Defect classification:** suggest a defect category and priority from technician notes.\n- **Knowledge retrieval:** answer “how was this fault fixed last time?” with citations to past jobs.\n\n## Safety is not optional\n\nSafety-critical steps are deterministic workflow gates, not AI suggestions. A job can't be marked complete without its required isolation confirmations, and an AI summary is never accepted as evidence that a safety step happened.\n\n## Offline and mobile by default\n\nField work happens where connectivity doesn't. Job packs sync ahead of time, data captured offline is queued, and conflicts are resolved by explicit rules. None of this is added late: it's part of the foundation.\n\n## Integrations\n\nEAM\u002FCMMS (such as SAP PM or Maximo), GIS, outage management, CRM, workforce management, inventory and ERP, and the identity provider for contractor access.\n\n## Who uses it\n\nField technicians and supervisors, planners and schedulers, control-room staff, HSE teams and asset managers.\n\n## First scope\n\nOne work type with a visible problem, for example inspection backlog or poor completion evidence, in one region. Measure first-time fix, evidence completeness and backlog ageing. Scope it in a [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint).\n\nSee [energy and utilities](\u002Findustries\u002Fenergy-utilities), explore the [Atlas](\u002Fatlas), or [bring us your work orders](\u002Fcontact).\n","\u003Cp>Utilities run on field work: inspections, maintenance, connections, fault repairs, meter work and emergency response. The field crews are skilled. The coordination around them often isn't. Work orders come out of the EAM system, get printed or messaged, and are completed on paper or in a spreadsheet. Evidence of what was done, and whether it was done safely, arrives late or incomplete.\u003C\u002Fp>\n\u003Ch2>What the application does\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>field service\u003C\u002Fstrong> family in the Atlas covers the full job lifecycle:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Work intake:\u003C\u002Fstrong> planned maintenance, customer requests and faults arrive as work orders from EAM, CRM or outage systems.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Planning:\u003C\u002Fstrong> jobs are grouped, sequenced and matched to crew skills, certifications, equipment and permits.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Dispatch:\u003C\u002Fstrong> assignment to crews, with changes pushed to mobile devices.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Job packs:\u003C\u002Fstrong> asset history, drawings, procedures and safety requirements, available offline.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Execution:\u003C\u002Fstrong> mobile checklists, readings, photos and materials used, captured as structured data.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Safety checkpoints:\u003C\u002Fstrong> permit-to-work, isolation confirmations and hazard assessments as mandatory steps.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Completion and evidence:\u003C\u002Fstrong> sign-off, updates back to the asset record and customer notification.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reporting:\u003C\u002Fstrong> productivity, first-time fix, backlog and compliance.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Scheduling and dispatch optimization:\u003C\u002Fstrong> suggest crew assignments and routes, while supervisors keep the final say.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Job-pack assembly:\u003C\u002Fstrong> retrieve the relevant procedures, asset history and past defect notes for this asset.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Photo and document intelligence:\u003C\u002Fstrong> check that required photos and readings are present and legible before a job closes.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Defect classification:\u003C\u002Fstrong> suggest a defect category and priority from technician notes.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Knowledge retrieval:\u003C\u002Fstrong> answer “how was this fault fixed last time?” with citations to past jobs.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Safety is not optional\u003C\u002Fh2>\n\u003Cp>Safety-critical steps are deterministic workflow gates, not AI suggestions. A job can't be marked complete without its required isolation confirmations, and an AI summary is never accepted as evidence that a safety step happened.\u003C\u002Fp>\n\u003Ch2>Offline and mobile by default\u003C\u002Fh2>\n\u003Cp>Field work happens where connectivity doesn't. Job packs sync ahead of time, data captured offline is queued, and conflicts are resolved by explicit rules. None of this is added late: it's part of the foundation.\u003C\u002Fp>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>EAM\u002FCMMS (such as SAP PM or Maximo), GIS, outage management, CRM, workforce management, inventory and ERP, and the identity provider for contractor access.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>Field technicians and supervisors, planners and schedulers, control-room staff, HSE teams and asset managers.\u003C\u002Fp>\n\u003Ch2>First scope\u003C\u002Fh2>\n\u003Cp>One work type with a visible problem, for example inspection backlog or poor completion evidence, in one region. Measure first-time fix, evidence completeness and backlog ageing. Scope it in a \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>See \u003Ca href=\"\u002Findustries\u002Fenergy-utilities\">energy and utilities\u003C\u002Fa>, explore the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your work orders\u003C\u002Fa>.\u003C\u002Fp>\n","Field service for utilities: work orders, crews and completion evidence","Field-service applications for energy and utilities: job packs, crew dispatch, mobile completion, safety checkpoints and AI-assisted planning.",[58,59,13,14],"energy-utilities","field-operations","2026-08-11T00:00:00.000Z",{"id":62,"slug":63,"body":64,"html":65,"title":66,"description":67,"category":31,"tags":68,"author":17,"date":69,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Findustry-applications\u002Foperational-risk-on-live-data","operational-risk-on-live-data","\nOperational risk functions are often stuck in a cycle: collect risk and control self-assessments in spreadsheets, consolidate them, report quarterly, repeat. By the time a report reaches the risk committee, the data is weeks old and the links between incidents, risks and controls have been lost along the way.\n\n## The connected model\n\nThe **risk management** family in the Atlas connects the objects risk teams already work with:\n\n- **Risk register:** risks by process, product and entity, with inherent and residual ratings.\n- **Controls:** mapped to risks, with owners and testing results.\n- **Key risk indicators:** thresholds and trends fed from source systems, not typed in.\n- **Incidents and loss events:** captured, classified, investigated and linked to the risks they reveal.\n- **Issues and actions:** remediation with owners, dates and verification.\n- **Assessments:** risk and control self-assessments run as workflows rather than spreadsheets.\n\nWhen these live in one application, questions like “which controls failed before this incident?” or “which risks have deteriorating KRIs and overdue actions?” become queries instead of projects.\n\n## Where AI helps\n\n- **Incident classification:** suggest a taxonomy category, root cause and the linked risks from the incident narrative.\n- **Pattern detection:** surface clusters of similar incidents across business units.\n- **Anomaly detection on KRIs:** flag unusual movements before they breach thresholds.\n- **Summarization:** draft committee papers from the underlying records, clearly marked as drafts.\n- **Assessment support:** pre-fill self-assessment answers from last cycle's evidence for owners to confirm or correct.\n\nRatings and risk acceptance stay with people. The application records when AI suggestions were used and whether they were accepted.\n\n## Who uses it\n\nRisk officers and operational risk teams, business-line risk champions, control owners, internal audit and executive management.\n\n## Integrations\n\nSource systems for KRI data, incident intake from ITSM and security tools, HR for ownership, finance for loss data, and the identity provider for role-based access to sensitive incidents.\n\n## Controls designed in\n\n- Four-eyes review of risk ratings\n- Evidence required for closing actions\n- Restricted visibility for sensitive investigations\n- A complete audit trail of rating changes\n\n## Why now\n\nSupervisors increasingly expect operational resilience: important business services mapped, impact tolerances set and scenarios tested. That is hard to evidence from spreadsheets. A connected risk application makes the mapping explicit and keeps it current.\n\n## First scope\n\nStart with incidents and KRIs for one business line, since that's where live data changes the conversation fastest, then extend to assessments. We'd scope it in a [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint).\n\nSee [financial services](\u002Findustries\u002Ffinancial-services), explore the [Atlas](\u002Fatlas), or [bring us your risk workflow](\u002Fcontact).\n","\u003Cp>Operational risk functions are often stuck in a cycle: collect risk and control self-assessments in spreadsheets, consolidate them, report quarterly, repeat. By the time a report reaches the risk committee, the data is weeks old and the links between incidents, risks and controls have been lost along the way.\u003C\u002Fp>\n\u003Ch2>The connected model\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>risk management\u003C\u002Fstrong> family in the Atlas connects the objects risk teams already work with:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Risk register:\u003C\u002Fstrong> risks by process, product and entity, with inherent and residual ratings.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Controls:\u003C\u002Fstrong> mapped to risks, with owners and testing results.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Key risk indicators:\u003C\u002Fstrong> thresholds and trends fed from source systems, not typed in.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Incidents and loss events:\u003C\u002Fstrong> captured, classified, investigated and linked to the risks they reveal.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Issues and actions:\u003C\u002Fstrong> remediation with owners, dates and verification.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Assessments:\u003C\u002Fstrong> risk and control self-assessments run as workflows rather than spreadsheets.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>When these live in one application, questions like “which controls failed before this incident?” or “which risks have deteriorating KRIs and overdue actions?” become queries instead of projects.\u003C\u002Fp>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Incident classification:\u003C\u002Fstrong> suggest a taxonomy category, root cause and the linked risks from the incident narrative.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pattern detection:\u003C\u002Fstrong> surface clusters of similar incidents across business units.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Anomaly detection on KRIs:\u003C\u002Fstrong> flag unusual movements before they breach thresholds.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Summarization:\u003C\u002Fstrong> draft committee papers from the underlying records, clearly marked as drafts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Assessment support:\u003C\u002Fstrong> pre-fill self-assessment answers from last cycle's evidence for owners to confirm or correct.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Ratings and risk acceptance stay with people. The application records when AI suggestions were used and whether they were accepted.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>Risk officers and operational risk teams, business-line risk champions, control owners, internal audit and executive management.\u003C\u002Fp>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>Source systems for KRI data, incident intake from ITSM and security tools, HR for ownership, finance for loss data, and the identity provider for role-based access to sensitive incidents.\u003C\u002Fp>\n\u003Ch2>Controls designed in\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Four-eyes review of risk ratings\u003C\u002Fli>\n\u003Cli>Evidence required for closing actions\u003C\u002Fli>\n\u003Cli>Restricted visibility for sensitive investigations\u003C\u002Fli>\n\u003Cli>A complete audit trail of rating changes\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Why now\u003C\u002Fh2>\n\u003Cp>Supervisors increasingly expect operational resilience: important business services mapped, impact tolerances set and scenarios tested. That is hard to evidence from spreadsheets. A connected risk application makes the mapping explicit and keeps it current.\u003C\u002Fp>\n\u003Ch2>First scope\u003C\u002Fh2>\n\u003Cp>Start with incidents and KRIs for one business line, since that's where live data changes the conversation fastest, then extend to assessments. We'd scope it in a \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>See \u003Ca href=\"\u002Findustries\u002Ffinancial-services\">financial services\u003C\u002Fa>, explore the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your risk workflow\u003C\u002Fa>.\u003C\u002Fp>\n","Operational risk management that runs on live data, not quarterly spreadsheets","Risk registers, KRIs, incidents and control testing as one connected application, with AI that helps risk teams see patterns earlier.",[45,47,46,15,14],"2026-07-30T00:00:00.000Z",7,{"id":72,"slug":73,"body":74,"html":75,"title":76,"description":77,"category":31,"tags":78,"author":17,"date":83,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Findustry-applications\u002Fai-in-the-soc-triage-and-investigation","ai-in-the-soc-triage-and-investigation","\nSecurity operations centres don't lack alerts. They lack analyst time. Every tool in the stack produces detections, and many are duplicates, benign or low value. Real incidents compete for attention with noise, and analysts spend a large share of their day gathering context rather than making judgements.\n\n## What the application does\n\nThe **security operations** family in the Atlas focuses on the workflow between detection and response:\n\n1. **Ingest:** alerts from SIEM, EDR, email security, identity and cloud security tools, normalized into one model.\n2. **Enrich:** asset ownership, user context, threat intelligence and related alerts attached automatically.\n3. **Correlate:** group related alerts into a single investigation.\n4. **Triage:** prioritize by severity, asset criticality and confidence.\n5. **Investigate:** a case with a timeline, evidence, notes and tasks.\n6. **Respond:** response actions through the organization's tools, with approvals for high-impact steps.\n7. **Close and learn:** a disposition, lessons learned and tuning feedback to the detection owners.\n8. **Report:** metrics for SOC leadership and control evidence for audit.\n\n## Where AI helps\n\n- **Summarization:** a plain-language summary of what happened, affected assets and the evidence so far.\n- **Triage support:** a suggested priority and likely disposition, with the reasoning shown.\n- **Investigation assistance:** suggested next queries and pivots, and drafted incident timelines.\n- **Agentic enrichment:** bounded, read-only lookups across tools to assemble context before an analyst opens the case.\n- **Reporting:** draft incident reports and management summaries.\n\n## Guardrails that matter here\n\nSecurity is where uncontrolled automation does the most damage. The application enforces:\n\n- **Read-only by default.** Enrichment agents can look, not act.\n- **Human approval for containment.** Isolating hosts, disabling accounts and blocking traffic require an analyst, and a second approver for high-impact actions.\n- **Prompt-injection awareness.** Alert content is treated as untrusted data, never as instructions.\n- **A full audit trail** of every AI suggestion, every action and who approved it.\n\nWe cover the general pattern in [agentic automation with human checkpoints](\u002Fblog\u002Fagentic-automation-with-human-checkpoints).\n\n## Who uses it\n\nSOC analysts (tier 1 to 3), incident responders, SOC managers, CISOs, and control owners who need evidence for audits.\n\n## Integrations\n\nSIEM and log platforms, EDR\u002FXDR, identity providers, email security, cloud security posture tools, ticketing and ITSM, threat intelligence feeds, and asset inventories or CMDBs.\n\n## Measuring it honestly\n\nTrack time to triage, time to contain, the share of alerts closed as benign and analyst hours per incident. Agree the baseline first. Improvements should show up in your own metrics, not in vendor claims.\n\n## Where it applies\n\nEnterprise SOCs, managed security providers, financial institutions with regulatory incident-reporting obligations, and government security operations.\n\nExplore the [Atlas](\u002Fatlas), or [bring us your triage queue](\u002Fcontact).\n","\u003Cp>Security operations centres don't lack alerts. They lack analyst time. Every tool in the stack produces detections, and many are duplicates, benign or low value. Real incidents compete for attention with noise, and analysts spend a large share of their day gathering context rather than making judgements.\u003C\u002Fp>\n\u003Ch2>What the application does\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>security operations\u003C\u002Fstrong> family in the Atlas focuses on the workflow between detection and response:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Ingest:\u003C\u002Fstrong> alerts from SIEM, EDR, email security, identity and cloud security tools, normalized into one model.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Enrich:\u003C\u002Fstrong> asset ownership, user context, threat intelligence and related alerts attached automatically.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Correlate:\u003C\u002Fstrong> group related alerts into a single investigation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Triage:\u003C\u002Fstrong> prioritize by severity, asset criticality and confidence.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Investigate:\u003C\u002Fstrong> a case with a timeline, evidence, notes and tasks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Respond:\u003C\u002Fstrong> response actions through the organization's tools, with approvals for high-impact steps.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Close and learn:\u003C\u002Fstrong> a disposition, lessons learned and tuning feedback to the detection owners.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Report:\u003C\u002Fstrong> metrics for SOC leadership and control evidence for audit.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Summarization:\u003C\u002Fstrong> a plain-language summary of what happened, affected assets and the evidence so far.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Triage support:\u003C\u002Fstrong> a suggested priority and likely disposition, with the reasoning shown.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Investigation assistance:\u003C\u002Fstrong> suggested next queries and pivots, and drafted incident timelines.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Agentic enrichment:\u003C\u002Fstrong> bounded, read-only lookups across tools to assemble context before an analyst opens the case.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reporting:\u003C\u002Fstrong> draft incident reports and management summaries.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Guardrails that matter here\u003C\u002Fh2>\n\u003Cp>Security is where uncontrolled automation does the most damage. The application enforces:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Read-only by default.\u003C\u002Fstrong> Enrichment agents can look, not act.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Human approval for containment.\u003C\u002Fstrong> Isolating hosts, disabling accounts and blocking traffic require an analyst, and a second approver for high-impact actions.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Prompt-injection awareness.\u003C\u002Fstrong> Alert content is treated as untrusted data, never as instructions.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>A full audit trail\u003C\u002Fstrong> of every AI suggestion, every action and who approved it.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>We cover the general pattern in \u003Ca href=\"\u002Fblog\u002Fagentic-automation-with-human-checkpoints\">agentic automation with human checkpoints\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>SOC analysts (tier 1 to 3), incident responders, SOC managers, CISOs, and control owners who need evidence for audits.\u003C\u002Fp>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>SIEM and log platforms, EDR\u002FXDR, identity providers, email security, cloud security posture tools, ticketing and ITSM, threat intelligence feeds, and asset inventories or CMDBs.\u003C\u002Fp>\n\u003Ch2>Measuring it honestly\u003C\u002Fh2>\n\u003Cp>Track time to triage, time to contain, the share of alerts closed as benign and analyst hours per incident. Agree the baseline first. Improvements should show up in your own metrics, not in vendor claims.\u003C\u002Fp>\n\u003Ch2>Where it applies\u003C\u002Fh2>\n\u003Cp>Enterprise SOCs, managed security providers, financial institutions with regulatory incident-reporting obligations, and government security operations.\u003C\u002Fp>\n\u003Cp>Explore the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your triage queue\u003C\u002Fa>.\u003C\u002Fp>\n","AI in the SOC: alert triage and investigation with evidence","Security operations applications that use AI to enrich, summarize and prioritize alerts while analysts keep the decisions and the evidence trail.",[79,80,14,81,82],"cybersecurity","case-management","human-in-the-loop","agents","2026-07-28T00:00:00.000Z",{"id":85,"slug":86,"body":87,"html":88,"title":89,"description":90,"category":91,"tags":92,"author":17,"date":94,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Fai-in-production\u002Fdocument-intelligence-in-regulated-workflows","document-intelligence-in-regulated-workflows","\nRegulated workflows run on documents: identity documents, company registries, financial statements, invoices, contracts, permits, medical referrals, supplier certificates, audit reports. Extracting data from them is among the most valuable uses of AI, and among the easiest to get subtly wrong.\n\nA demo extracts ten fields from a clean PDF perfectly. Production brings scans, photos, handwriting, multiple languages, unusual layouts and documents that are simply the wrong document.\n\n## The production pattern\n\n**1. Classify first.** Before extracting anything, determine what the document is. A bank statement sent where a trade licence was expected should be caught at the door.\n\n**2. Extract to a schema.** Every document type has a defined schema of fields, types and formats. The model's output is validated against it, and anything that doesn't conform is rejected.\n\n**3. Validate against rules and sources.** Cross-check extracted values: totals that should add up, dates that should be in order, registration numbers that should exist in a registry, names that should match the application.\n\n**4. Carry confidence and provenance.** Every extracted field records where it came from on the page and how confident the extraction is. Reviewers see the source next to the value.\n\n**5. Route by confidence and risk.** High-confidence, low-risk fields flow straight through. Low-confidence or high-risk fields go to a human review queue. The thresholds are business decisions, not model defaults.\n\n**6. Learn from corrections.** Every human correction is recorded and becomes evaluation data for the next model or prompt change.\n\n## Where it appears across the Atlas\n\nDocument intelligence isn't a product on its own. It's a capability inside many application families:\n\n- **Onboarding and KYC\u002FKYB:** identity and company documents\n- **Case management:** evidence submitted by applicants ([AI-assisted case management](\u002Fblog\u002Fai-assisted-case-management))\n- **Referrals and pre-authorization** in healthcare ([care coordination](\u002Fblog\u002Freferrals-and-care-coordination))\n- **Permits** in the built environment ([permitting and inspections](\u002Fblog\u002Fpermitting-and-inspections-for-the-built-environment))\n- **Supplier assurance:** SOC reports and certificates ([third-party risk](\u002Fblog\u002Fthird-party-and-supplier-risk-reviews))\n- **Finance:** remittances and statements ([reconciliation](\u002Fblog\u002Freconciliation-and-exception-workbenches))\n\n## Controls designed in\n\n- Original documents retained, unaltered, with hashes\n- Extracted values linked to their source location\n- Every human override recorded, with the reviewer and reason\n- Access to sensitive documents restricted by role and logged\n- The model provider and hosting chosen to meet data-residency requirements\n\n## Measuring it honestly\n\nField-level accuracy on a held-out test set per document type, straight-through processing rate, review queue volume and correction rate. Agree the thresholds with the business and compliance owners before launch. See [evaluation and guardrails](\u002Fblog\u002Fevaluation-and-guardrails-before-production).\n\n## Arabic and bilingual documents\n\nIn the GCC, many documents are Arabic, English or both, and include stamps, signatures and handwriting. Test sets must reflect that mix from day one. Performance on English samples says little about performance on the documents you'll actually receive.\n\n[Bring us the document types](\u002Fcontact) that slow your workflow down.\n","\u003Cp>Regulated workflows run on documents: identity documents, company registries, financial statements, invoices, contracts, permits, medical referrals, supplier certificates, audit reports. Extracting data from them is among the most valuable uses of AI, and among the easiest to get subtly wrong.\u003C\u002Fp>\n\u003Cp>A demo extracts ten fields from a clean PDF perfectly. Production brings scans, photos, handwriting, multiple languages, unusual layouts and documents that are simply the wrong document.\u003C\u002Fp>\n\u003Ch2>The production pattern\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>1. Classify first.\u003C\u002Fstrong> Before extracting anything, determine what the document is. A bank statement sent where a trade licence was expected should be caught at the door.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>2. Extract to a schema.\u003C\u002Fstrong> Every document type has a defined schema of fields, types and formats. The model's output is validated against it, and anything that doesn't conform is rejected.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>3. Validate against rules and sources.\u003C\u002Fstrong> Cross-check extracted values: totals that should add up, dates that should be in order, registration numbers that should exist in a registry, names that should match the application.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>4. Carry confidence and provenance.\u003C\u002Fstrong> Every extracted field records where it came from on the page and how confident the extraction is. Reviewers see the source next to the value.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>5. Route by confidence and risk.\u003C\u002Fstrong> High-confidence, low-risk fields flow straight through. Low-confidence or high-risk fields go to a human review queue. The thresholds are business decisions, not model defaults.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>6. Learn from corrections.\u003C\u002Fstrong> Every human correction is recorded and becomes evaluation data for the next model or prompt change.\u003C\u002Fp>\n\u003Ch2>Where it appears across the Atlas\u003C\u002Fh2>\n\u003Cp>Document intelligence isn't a product on its own. It's a capability inside many application families:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Onboarding and KYC\u002FKYB:\u003C\u002Fstrong> identity and company documents\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Case management:\u003C\u002Fstrong> evidence submitted by applicants (\u003Ca href=\"\u002Fblog\u002Fai-assisted-case-management\">AI-assisted case management\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Referrals and pre-authorization\u003C\u002Fstrong> in healthcare (\u003Ca href=\"\u002Fblog\u002Freferrals-and-care-coordination\">care coordination\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Permits\u003C\u002Fstrong> in the built environment (\u003Ca href=\"\u002Fblog\u002Fpermitting-and-inspections-for-the-built-environment\">permitting and inspections\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Supplier assurance:\u003C\u002Fstrong> SOC reports and certificates (\u003Ca href=\"\u002Fblog\u002Fthird-party-and-supplier-risk-reviews\">third-party risk\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Finance:\u003C\u002Fstrong> remittances and statements (\u003Ca href=\"\u002Fblog\u002Freconciliation-and-exception-workbenches\">reconciliation\u003C\u002Fa>)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Controls designed in\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Original documents retained, unaltered, with hashes\u003C\u002Fli>\n\u003Cli>Extracted values linked to their source location\u003C\u002Fli>\n\u003Cli>Every human override recorded, with the reviewer and reason\u003C\u002Fli>\n\u003Cli>Access to sensitive documents restricted by role and logged\u003C\u002Fli>\n\u003Cli>The model provider and hosting chosen to meet data-residency requirements\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Measuring it honestly\u003C\u002Fh2>\n\u003Cp>Field-level accuracy on a held-out test set per document type, straight-through processing rate, review queue volume and correction rate. Agree the thresholds with the business and compliance owners before launch. See \u003Ca href=\"\u002Fblog\u002Fevaluation-and-guardrails-before-production\">evaluation and guardrails\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2>Arabic and bilingual documents\u003C\u002Fh2>\n\u003Cp>In the GCC, many documents are Arabic, English or both, and include stamps, signatures and handwriting. Test sets must reflect that mix from day one. Performance on English samples says little about performance on the documents you'll actually receive.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"\u002Fcontact\">Bring us the document types\u003C\u002Fa> that slow your workflow down.\u003C\u002Fp>\n","Document intelligence in regulated workflows: extraction with verification","Extracting data from documents with AI is easy to demo and hard to trust. How to build extraction with validation, confidence and human review.","ai-in-production",[35,81,14,93],"production","2026-07-23T00:00:00.000Z",{"id":96,"slug":97,"body":98,"html":99,"title":100,"description":101,"category":91,"tags":102,"author":17,"date":103,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Fai-in-production\u002Fagentic-automation-with-human-checkpoints","agentic-automation-with-human-checkpoints","\nAgents, meaning AI systems that plan and take multi-step actions with tools, are the most exciting and the most dangerous AI capability in the enterprise. An agent that gathers context from five systems before an analyst opens a case saves real time. An agent that closes accounts, moves money or emails customers on its own is a governance incident waiting to happen.\n\nThe answer isn't to avoid agents. It's to put them inside a workflow with **checkpoints**.\n\n## Design principles\n\n**1. Bounded tools.** An agent can only call tools that the application explicitly exposes to it, each with a narrow purpose and validated inputs. No general shell, no arbitrary API access.\n\n**2. Read before write.** Most value comes from read-only work: gathering context, correlating records, drafting. Make read-only the default and treat every write as a separate, higher-risk capability.\n\n**3. Explicit approval for consequential actions.** Anything that changes a record of consequence, contacts a customer, moves value or changes access requires a person to approve. Some actions require two people.\n\n**4. Identity and least privilege.** The agent acts with its own service identity or on behalf of a user, never with broader permissions than the user who invoked it.\n\n**5. Deterministic workflow state.** The workflow engine, not the model, decides what state a case is in and what happens next. The agent proposes, and the workflow disposes.\n\n**6. Untrusted input.** Content the agent reads (emails, documents, alerts, web pages) is data. Instructions embedded in it are ignored, and attempts are logged.\n\n**7. Full traceability.** Every plan, tool call, input, output, approval and rejection is recorded, so reviewers can reconstruct why something happened.\n\n## Where agents earn their keep\n\n- **Case preparation:** assemble customer, transaction and history context before a human opens the case. See [AI-assisted case management](\u002Fblog\u002Fai-assisted-case-management).\n- **Security enrichment:** read-only lookups across security tools. See [AI in the SOC](\u002Fblog\u002Fai-in-the-soc-triage-and-investigation).\n- **Document workflows:** extract, validate and route documents, and escalate what fails validation.\n- **Operations recovery:** generate and score recovery options for a controller to choose from. See [operations control](\u002Fblog\u002Foperations-control-and-disruption-management).\n- **Reconciliation:** propose matches and classify breaks for an analyst to confirm.\n\nIn each case, the agent compresses the time *before* a human decision. It doesn't replace the decision.\n\n## What to measure\n\nTime saved before the decision point, how often agent proposals are accepted unchanged, the rejection reasons, how often approval gates fire, and incidents caused by agent actions. That last number should be zero, and the design should make it hard to be anything else.\n\n## How it fits the architecture\n\nIn our application foundations, agent tools are ordinary application services with contracts, authorization and tests. That's the same discipline as any other API. This is the practical meaning of [AI accelerates the implementation, architecture governs it](\u002Fblog\u002Fai-accelerates-architecture-governs).\n\n[Bring us a workflow](\u002Fcontact) where an agent could prepare the decision, and we'll scope the checkpoints with you.\n","\u003Cp>Agents, meaning AI systems that plan and take multi-step actions with tools, are the most exciting and the most dangerous AI capability in the enterprise. An agent that gathers context from five systems before an analyst opens a case saves real time. An agent that closes accounts, moves money or emails customers on its own is a governance incident waiting to happen.\u003C\u002Fp>\n\u003Cp>The answer isn't to avoid agents. It's to put them inside a workflow with \u003Cstrong>checkpoints\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Ch2>Design principles\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>1. Bounded tools.\u003C\u002Fstrong> An agent can only call tools that the application explicitly exposes to it, each with a narrow purpose and validated inputs. No general shell, no arbitrary API access.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>2. Read before write.\u003C\u002Fstrong> Most value comes from read-only work: gathering context, correlating records, drafting. Make read-only the default and treat every write as a separate, higher-risk capability.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>3. Explicit approval for consequential actions.\u003C\u002Fstrong> Anything that changes a record of consequence, contacts a customer, moves value or changes access requires a person to approve. Some actions require two people.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>4. Identity and least privilege.\u003C\u002Fstrong> The agent acts with its own service identity or on behalf of a user, never with broader permissions than the user who invoked it.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>5. Deterministic workflow state.\u003C\u002Fstrong> The workflow engine, not the model, decides what state a case is in and what happens next. The agent proposes, and the workflow disposes.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>6. Untrusted input.\u003C\u002Fstrong> Content the agent reads (emails, documents, alerts, web pages) is data. Instructions embedded in it are ignored, and attempts are logged.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>7. Full traceability.\u003C\u002Fstrong> Every plan, tool call, input, output, approval and rejection is recorded, so reviewers can reconstruct why something happened.\u003C\u002Fp>\n\u003Ch2>Where agents earn their keep\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Case preparation:\u003C\u002Fstrong> assemble customer, transaction and history context before a human opens the case. See \u003Ca href=\"\u002Fblog\u002Fai-assisted-case-management\">AI-assisted case management\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Security enrichment:\u003C\u002Fstrong> read-only lookups across security tools. See \u003Ca href=\"\u002Fblog\u002Fai-in-the-soc-triage-and-investigation\">AI in the SOC\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Document workflows:\u003C\u002Fstrong> extract, validate and route documents, and escalate what fails validation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Operations recovery:\u003C\u002Fstrong> generate and score recovery options for a controller to choose from. See \u003Ca href=\"\u002Fblog\u002Foperations-control-and-disruption-management\">operations control\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reconciliation:\u003C\u002Fstrong> propose matches and classify breaks for an analyst to confirm.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>In each case, the agent compresses the time \u003Cem>before\u003C\u002Fem> a human decision. It doesn't replace the decision.\u003C\u002Fp>\n\u003Ch2>What to measure\u003C\u002Fh2>\n\u003Cp>Time saved before the decision point, how often agent proposals are accepted unchanged, the rejection reasons, how often approval gates fire, and incidents caused by agent actions. That last number should be zero, and the design should make it hard to be anything else.\u003C\u002Fp>\n\u003Ch2>How it fits the architecture\u003C\u002Fh2>\n\u003Cp>In our application foundations, agent tools are ordinary application services with contracts, authorization and tests. That's the same discipline as any other API. This is the practical meaning of \u003Ca href=\"\u002Fblog\u002Fai-accelerates-architecture-governs\">AI accelerates the implementation, architecture governs it\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"\u002Fcontact\">Bring us a workflow\u003C\u002Fa> where an agent could prepare the decision, and we'll scope the checkpoints with you.\u003C\u002Fp>\n","Agentic automation with human checkpoints","How to use AI agents in enterprise workflows safely: bounded tools, read-before-write, explicit approvals and an audit trail of every step.",[82,81,93,14],"2026-07-14T00:00:00.000Z",{"id":105,"slug":106,"body":107,"html":108,"title":109,"description":110,"category":31,"tags":111,"author":17,"date":114,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Findustry-applications\u002Fcompliance-evidence-produced-by-the-workflow","compliance-evidence-produced-by-the-workflow","\nAsk any compliance team what the week before an audit looks like. Screenshots, exports, email searches and a shared folder that grows until someone declares it complete. The controls probably operated fine. The **evidence** of it was never captured as the work happened.\n\n## The pattern\n\nThe **compliance operations and evidence** family in the Atlas works from a simple principle: every control has an owner, a defined piece of evidence and a system that captures that evidence as a by-product of the work.\n\nA typical foundation includes:\n\n- **Control library.** Controls mapped to obligations, policies and processes, each with an owner and a testing frequency.\n- **Evidence requests and collection.** Scheduled or event-driven, with evidence attached to the control rather than to an email thread.\n- **Attestation workflows.** Owners attest, reviewers challenge and approvers sign off, all with a history.\n- **Exception and issue management.** Failed controls become issues with remediation owners and dates.\n- **Regulatory change intake.** New obligations are assessed and mapped to affected controls.\n- **Reporting and packs.** Audit and supervisory packs generated from the record.\n\n## Where AI helps\n\n- **Document intelligence:** extract the relevant clauses from policies and regulatory texts and propose control mappings for a human to confirm.\n- **Evidence classification:** check that an uploaded file actually matches what the control requires, and flag mismatches before a reviewer finds them.\n- **Summarization:** turn a quarter of attestations and issues into a readable management summary.\n- **Gap detection:** highlight controls with stale or missing evidence ahead of the audit.\n\nThe application records who accepted or rejected every AI suggestion. The AI never attests.\n\n## Who uses it\n\nCompliance officers, control owners across the business, internal audit, risk officers and, in the public sector, inspection and oversight teams.\n\n## Integrations\n\nTicketing and ITSM, where much evidence already lives. Document management. The identity provider, so attestations are tied to real people. HR systems for ownership changes. Data platforms for automated control tests.\n\n## The difference it makes\n\nAn evidence application changes the question from “can we prove it?” to “show me the record.” It also changes the economics. The effort moves from assembling evidence to operating controls, which is where it should have been all along.\n\n## Where it applies\n\nBanking and insurance, payments, government entities with internal-control obligations, and any organization with recurring audits (ISO, SOC or sector regulators). For licensed digital-asset operators, the same foundation handles KYC, KYT and Travel Rule operations. See [digital assets](\u002Findustries\u002Fdigital-assets).\n\n## A sensible first scope\n\nOne control domain, such as access reviews or third-party oversight, with its evidence moved into the application ahead of the next audit cycle. Scope it in a [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint), or [bring us the audit you dread most](\u002Fcontact).\n\n*fazeZERO builds and integrates applications. Regulatory interpretation stays with your compliance function and counsel.*\n","\u003Cp>Ask any compliance team what the week before an audit looks like. Screenshots, exports, email searches and a shared folder that grows until someone declares it complete. The controls probably operated fine. The \u003Cstrong>evidence\u003C\u002Fstrong> of it was never captured as the work happened.\u003C\u002Fp>\n\u003Ch2>The pattern\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>compliance operations and evidence\u003C\u002Fstrong> family in the Atlas works from a simple principle: every control has an owner, a defined piece of evidence and a system that captures that evidence as a by-product of the work.\u003C\u002Fp>\n\u003Cp>A typical foundation includes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Control library.\u003C\u002Fstrong> Controls mapped to obligations, policies and processes, each with an owner and a testing frequency.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence requests and collection.\u003C\u002Fstrong> Scheduled or event-driven, with evidence attached to the control rather than to an email thread.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Attestation workflows.\u003C\u002Fstrong> Owners attest, reviewers challenge and approvers sign off, all with a history.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Exception and issue management.\u003C\u002Fstrong> Failed controls become issues with remediation owners and dates.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Regulatory change intake.\u003C\u002Fstrong> New obligations are assessed and mapped to affected controls.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reporting and packs.\u003C\u002Fstrong> Audit and supervisory packs generated from the record.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Where AI helps\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Document intelligence:\u003C\u002Fstrong> extract the relevant clauses from policies and regulatory texts and propose control mappings for a human to confirm.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence classification:\u003C\u002Fstrong> check that an uploaded file actually matches what the control requires, and flag mismatches before a reviewer finds them.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Summarization:\u003C\u002Fstrong> turn a quarter of attestations and issues into a readable management summary.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Gap detection:\u003C\u002Fstrong> highlight controls with stale or missing evidence ahead of the audit.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The application records who accepted or rejected every AI suggestion. The AI never attests.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cp>Compliance officers, control owners across the business, internal audit, risk officers and, in the public sector, inspection and oversight teams.\u003C\u002Fp>\n\u003Ch2>Integrations\u003C\u002Fh2>\n\u003Cp>Ticketing and ITSM, where much evidence already lives. Document management. The identity provider, so attestations are tied to real people. HR systems for ownership changes. Data platforms for automated control tests.\u003C\u002Fp>\n\u003Ch2>The difference it makes\u003C\u002Fh2>\n\u003Cp>An evidence application changes the question from “can we prove it?” to “show me the record.” It also changes the economics. The effort moves from assembling evidence to operating controls, which is where it should have been all along.\u003C\u002Fp>\n\u003Ch2>Where it applies\u003C\u002Fh2>\n\u003Cp>Banking and insurance, payments, government entities with internal-control obligations, and any organization with recurring audits (ISO, SOC or sector regulators). For licensed digital-asset operators, the same foundation handles KYC, KYT and Travel Rule operations. See \u003Ca href=\"\u002Findustries\u002Fdigital-assets\">digital assets\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2>A sensible first scope\u003C\u002Fh2>\n\u003Cp>One control domain, such as access reviews or third-party oversight, with its evidence moved into the application ahead of the next audit cycle. Scope it in a \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us the audit you dread most\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Cem>fazeZERO builds and integrates applications. Regulatory interpretation stays with your compliance function and counsel.\u003C\u002Fem>\u003C\u002Fp>\n","Compliance evidence should be produced by the workflow, not assembled for the audit","Regulatory evidence collection and control attestation as an application: controls mapped to evidence, captured as work happens, reviewed by owners.",[112,14,47,113,15],"compliance","government","2026-07-09T00:00:00.000Z",{"id":116,"slug":117,"body":118,"html":119,"title":120,"description":121,"category":31,"tags":122,"author":17,"date":125,"year":19,"month":70,"quarter":21,"status":22,"featured":23},"2026\u002F07\u002Findustry-applications\u002Fai-model-governance-as-an-application","ai-model-governance-as-an-application","\nMost enterprises now have an AI policy. Far fewer have an AI governance **system**. The policy says every model must be inventoried, evaluated, approved and monitored. In practice, the inventory is a spreadsheet, the evaluations are in notebooks, approvals happen in email and monitoring depends on whoever built the model.\n\nThat works for five models. It fails at fifty, and it fails immediately when an auditor or supervisor asks for evidence.\n\n## The workflow behind “AI governance”\n\nThe **AI governance** family in the Atlas treats governance as an operational workflow with a system of record:\n\n1. **Register.** Every model and AI use case gets an owner, a purpose, a risk tier, its data sources and where it is deployed. That includes vendor models, LLM features and internal models.\n2. **Evaluate.** Structured evaluations against defined criteria: accuracy, robustness, bias and fairness, and for LLM features, groundedness and safety. Results are stored as evidence, not screenshots.\n3. **Approve.** Deployment requests route through the right reviewers, such as model risk, security, the business owner and compliance, based on the risk tier. Every decision is recorded.\n4. **Monitor.** Production behaviour is tracked against thresholds. Drift and incidents raise cases with owners.\n5. **Evidence.** Packs for internal audit, the board or supervisors are generated from the record.\n\n## Where AI helps inside the governance application\n\nIt sounds recursive, but it's useful:\n\n- **Summarization** of model documentation and evaluation results for reviewers\n- **Classification** of new use cases into risk tiers, as a suggestion for a human to confirm\n- **Evaluation assistance**, generating test cases and red-team prompts for LLM features\n- **Drafting** evidence-pack narratives from structured records\n\nEvery one of these is a draft for a human. The approval decision is never automated.\n\n## Who uses it\n\n- **Head of AI and the AI platform team:** keep the portfolio visible and deployable.\n- **Model risk managers:** run reviews with consistent criteria.\n- **Risk and compliance officers:** answer supervisors and auditors from one record.\n- **CIO, CDO and CDAO:** see where AI is used, by whom, and at what risk.\n\n## Integrations that matter\n\nModel registries and ML platforms, CI\u002FCD pipelines (so deployment approval is a real gate rather than a formality), the identity provider for reviewer roles, ticketing, and data catalogues for lineage.\n\n## Controls designed in\n\n- Segregation between model owner and approver\n- An immutable decision history\n- Required evidence before approval can proceed\n- Periodic re-review based on risk tier and staleness\n- Role-based access to sensitive evaluation data\n\n## Why it belongs in financial services first\n\nBanks and insurers already run model risk management for credit and pricing models. Generative AI has multiplied the number of “models” and blurred their edges. A governance application extends existing discipline to the new portfolio instead of creating a parallel process.\n\nThe same foundation applies across enterprise operations, government and any organization preparing for AI-specific regulation.\n\n## Starting point\n\nThe fastest start is to take one line of business's AI inventory and move it into the application, with the approval workflow switched on for new deployments only. The [Solution Definition Sprint](\u002Fservices\u002Fsolution-definition-sprint) scopes the delta: your risk tiers, reviewers, evaluation criteria and integrations.\n\nSee the [financial services](\u002Findustries\u002Ffinancial-services) page, search the [Atlas](\u002Fatlas), or [bring us your AI inventory](\u002Fcontact).\n","\u003Cp>Most enterprises now have an AI policy. Far fewer have an AI governance \u003Cstrong>system\u003C\u002Fstrong>. The policy says every model must be inventoried, evaluated, approved and monitored. In practice, the inventory is a spreadsheet, the evaluations are in notebooks, approvals happen in email and monitoring depends on whoever built the model.\u003C\u002Fp>\n\u003Cp>That works for five models. It fails at fifty, and it fails immediately when an auditor or supervisor asks for evidence.\u003C\u002Fp>\n\u003Ch2>The workflow behind “AI governance”\u003C\u002Fh2>\n\u003Cp>The \u003Cstrong>AI governance\u003C\u002Fstrong> family in the Atlas treats governance as an operational workflow with a system of record:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Register.\u003C\u002Fstrong> Every model and AI use case gets an owner, a purpose, a risk tier, its data sources and where it is deployed. That includes vendor models, LLM features and internal models.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evaluate.\u003C\u002Fstrong> Structured evaluations against defined criteria: accuracy, robustness, bias and fairness, and for LLM features, groundedness and safety. Results are stored as evidence, not screenshots.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Approve.\u003C\u002Fstrong> Deployment requests route through the right reviewers, such as model risk, security, the business owner and compliance, based on the risk tier. Every decision is recorded.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Monitor.\u003C\u002Fstrong> Production behaviour is tracked against thresholds. Drift and incidents raise cases with owners.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence.\u003C\u002Fstrong> Packs for internal audit, the board or supervisors are generated from the record.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2>Where AI helps inside the governance application\u003C\u002Fh2>\n\u003Cp>It sounds recursive, but it's useful:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Summarization\u003C\u002Fstrong> of model documentation and evaluation results for reviewers\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Classification\u003C\u002Fstrong> of new use cases into risk tiers, as a suggestion for a human to confirm\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evaluation assistance\u003C\u002Fstrong>, generating test cases and red-team prompts for LLM features\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Drafting\u003C\u002Fstrong> evidence-pack narratives from structured records\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Every one of these is a draft for a human. The approval decision is never automated.\u003C\u002Fp>\n\u003Ch2>Who uses it\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Head of AI and the AI platform team:\u003C\u002Fstrong> keep the portfolio visible and deployable.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Model risk managers:\u003C\u002Fstrong> run reviews with consistent criteria.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Risk and compliance officers:\u003C\u002Fstrong> answer supervisors and auditors from one record.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>CIO, CDO and CDAO:\u003C\u002Fstrong> see where AI is used, by whom, and at what risk.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Integrations that matter\u003C\u002Fh2>\n\u003Cp>Model registries and ML platforms, CI\u002FCD pipelines (so deployment approval is a real gate rather than a formality), the identity provider for reviewer roles, ticketing, and data catalogues for lineage.\u003C\u002Fp>\n\u003Ch2>Controls designed in\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Segregation between model owner and approver\u003C\u002Fli>\n\u003Cli>An immutable decision history\u003C\u002Fli>\n\u003Cli>Required evidence before approval can proceed\u003C\u002Fli>\n\u003Cli>Periodic re-review based on risk tier and staleness\u003C\u002Fli>\n\u003Cli>Role-based access to sensitive evaluation data\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Why it belongs in financial services first\u003C\u002Fh2>\n\u003Cp>Banks and insurers already run model risk management for credit and pricing models. Generative AI has multiplied the number of “models” and blurred their edges. A governance application extends existing discipline to the new portfolio instead of creating a parallel process.\u003C\u002Fp>\n\u003Cp>The same foundation applies across enterprise operations, government and any organization preparing for AI-specific regulation.\u003C\u002Fp>\n\u003Ch2>Starting point\u003C\u002Fh2>\n\u003Cp>The fastest start is to take one line of business's AI inventory and move it into the application, with the approval workflow switched on for new deployments only. The \u003Ca href=\"\u002Fservices\u002Fsolution-definition-sprint\">Solution Definition Sprint\u003C\u002Fa> scopes the delta: your risk tiers, reviewers, evaluation criteria and integrations.\u003C\u002Fp>\n\u003Cp>See the \u003Ca href=\"\u002Findustries\u002Ffinancial-services\">financial services\u003C\u002Fa> page, search the \u003Ca href=\"\u002Fatlas\">Atlas\u003C\u002Fa>, or \u003Ca href=\"\u002Fcontact\">bring us your AI inventory\u003C\u002Fa>.\u003C\u002Fp>\n","AI model governance should be an application, not a policy document","Model inventory, evaluation, deployment approval and monitoring as one governed workflow, so AI governance produces evidence instead of meetings.",[123,47,124,14,45],"ai-governance","evaluation","2026-07-02T00:00:00.000Z",1790080513517]