Thinking & Perspectives
AI Strategy Insights
Practical perspectives on AI strategy, agentic systems architecture, and governance — from the advisory practice at Imagine Works.
When Agents Go Rogue: Containment Controls Boards Should Ask About
An AI agent does not just answer — it acts. So its failure mode is a wrong action in the real world, at machine speed. Boards do not need to understand the model to govern this; they need to ask a small number of containment questions and recognise a good answer from a reassuring one. Here are the six, and how they map to the EU AI Act, ISO/IEC 42001, and the NIST AI Risk Management Framework.
OWASP LLM05: Improper Output Handling (Formerly LLM02): Enterprise Guide
The 2025 OWASP Top 10 for LLM Applications renamed "Insecure Output Handling" (LLM02:2023) to "Improper Output Handling" (LLM05:2025) — but the underlying enterprise vulnerability is the same and, in most deployed LLM-integrated applications, it is still not fixed. Model output that gets rendered, executed, or interpolated downstream without sanitisation is how prompt injections cross the threshold from "the model said a bad thing" to XSS, SSRF, and remote code execution. Here is what LLM05 actually is, how it differs from prompt injection, and the controls that neutralise it.
AI Literacy: The EU AI Act Obligation Every Employer Now Faces
The EU AI Act's AI-literacy obligation entered into force on 2 February 2025, and 2 August 2026 is the Act's general date of application. The obligation applies whether or not the AI systems in question are high-risk, and whether the employer is a provider or a deployer. Here is what Article 4 requires after the Digital Omnibus amendment, how that differs from the original 2024 wording, and what a defensible programme looks like.
AI Audit: What Enterprise Leaders Should Actually Ask For
AI audit has moved from a niche practice to a board-level expectation. ISO/IEC 42006 gave auditors a formal accreditation standard in July 2025, KPMG's US firm announced ISO 42001 certification in November 2025, and the EU AI Act reached its general date of application on 2 August 2026. Here is what enterprise leaders should ask for when they commission — or prepare for — an AI audit.
AI Red Teaming: What Enterprise Leaders Should Actually Ask For
AI red teaming has moved from a research-lab activity to a boardroom expectation. The EU AI Act now requires adversarial testing of general-purpose AI models with systemic risk. Microsoft has red-teamed 100+ generative AI products since 2018. NIST published a formal adversarial-ML attack taxonomy in March 2025. Here is what enterprise leaders should ask for when they commission — or evaluate — an AI red team engagement.
The NIST AI Risk Management Framework: What Enterprise Leaders Need to Understand
The NIST AI Risk Management Framework (AI RMF 1.0) has quietly become the most widely adopted enterprise AI governance framework in the United States — 57–67% of CISOs use it according to the 2026 Hitch Partners Global CISO Leadership Report. Voluntary, but load-bearing. Here is what the framework contains, how the 2024 Generative AI Profile extends it, and why it endured a change of US administration when the executive order that popularised it did not.