Product Lead, AI Platforms. I build AI for organisations that cannot put their data in someone else's cloud. The kind where data residency is the first question in the room.

Agents, the knowledge they work from, and the governance controls around both, running inside the customer's environment rather than politely beside it. The other half is the security side: red teaming, guardrails, runtime monitoring. All of it has to map to whichever framework the buyer's auditor already trusts, which is usually the NIST AI RMF and increasingly ISO 42001.

Underneath that it is one question in different outfits. What does an enterprise need to see before it will let an agent act on its behalf? Nobody has a clean answer yet. I am fairly sure it is not a slide.

Most of what I put here lands on the same problem: deciding what "good" means before the model does something strange at 2am. It is slow work.

Lanes are where accountability goes to die.

No Lanes. If it ships under my name it is mine. The spec, the demo, the threat model, the pricing page. "That's not my lane" is a sentence I have never heard improve an outcome.

Governance is a product surface. Not a PDF filed after launch.

Write the eval before the roadmap. A claim you cannot test is not a requirement, it is a hope with a deadline attached.

• red-tape  ·  Skills that make a coding agent handle the AI rules of the thing it just built. Written after measuring the problem: asked "are you a real person" the generated systems own up 9 times out of 10, asked "when does your shift end" they own up 3 times out of 10. The failure was never a missing disclosure. It was evasion.
• ai-governance-evals  ·  Runnable probes for the governance obligations you can observe. Point it at a model or an agent and it tells you where you fail. I pointed a model at the first version and it broke all twenty of my graders, which was humbling and is now a test file.
• ai-governance-checklist  ·  The other half. Intake triage, PRD template and launch gate, structured on the EU AI Act, the NIST AI RMF and ISO 42001. Every obligation names an article, an artefact and the person who signs it.
• aigp-coach  ·  A study system for the IAPP AIGP exam that tells you why you missed a question, not just that you did. Built for a userbase of one. I was the one.

Longer, more earnest things live at mahmadafzal.com.

Follow the work here or on LinkedIn, though email is the one I read. Always up for a conversation about governing AI in places where the rules are still being written.

_{This profile is text on purpose. Views here are my own, not my employer's.}