Timeless Compliance: Why Better Questions Beat Bigger Frameworks
In 2009, a surgeon named Atul Gawande and a team backed by the World Health Organization showed that a 19-item surgical checklist could cut complications and deaths by dramatic margins across eight hospitals worldwide. Not a thousand-page protocol. Not a comprehensive framework. Nineteen items, printed on a single card. Aviation learned the same lesson decades earlier: the pre-flight checklist fits in a pilot’s hand, not in a binder. Nearly two decades later, I watch security teams send AI vendors questionnaires with 300 questions, half of which begin with “describe your approach to…” and almost none of which would catch a real failure. We have the frameworks. What we don’t have is the checklist.
The timing matters. The EU AI Act’s enforcement teeth for general-purpose AI arrive this August, high-risk obligations are phasing in behind them, and ISO/IEC 42001 is now showing up by name in third-party risk questionnaires. NIST’s AI...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
