Draxion briefings
Practical guidance on shadow AI, regulatory compliance, and enterprise AI governance — no vendor theatre, no recycled analyst copy.
Lead briefing
Most organizations interpret EU AI Act Article 9 as requiring a risk management system for high-risk AI. What it actually requires is significantly more specific — and most compliance teams are not meeting the standard they think they are.
The index
Filter by topic. Each entry carries its date, read time and desk classification so you can decide what is worth your next ten minutes.
06 / 06 briefings
The data is consistent across every organization we have spoken to. The question is not whether your employees are using unapproved AI — it is how many tools, which data, and what your liability is.
Draxion Team
The prohibited AI provisions of the EU AI Act became enforceable in February 2025. The high-risk AI obligations come into force in August 2026. Most organizations are not ready. Here is what you need to do.
Draxion Team
Having a written AI acceptable use policy is not GDPR compliance. It is evidence that you identified the risk. Here is what actual compliance looks like — and how regulators test for it.
Draxion Team
Organizations spend their governance energy on ChatGPT because it is visible. The real exposure is in the 15–20 other AI tools your employees are using that you have never heard of.
Draxion Team
Every AI vendor your employees use is a data processor under GDPR Article 28. Most enterprise AI vendor contracts do not satisfy Article 28 requirements. Here is what to look for.
Draxion Team
A practical, step-by-step guide for IT security and compliance teams who need to demonstrate AI governance to their board or auditors — without a six-month project timeline.
Draxion Team
Coverage
We write about the areas we build against every day. If a subject does not affect how an organization detects, documents or defends its AI usage, it does not get a briefing.
Which unapproved tools are in use, who is using them, and what leaves the building with them.
Risk classes, Article-level obligations, and the enforcement clock running to August 2026.
What auditors actually test for — and why a written policy is evidence, not compliance.
Processor obligations, Article 28 data processing agreements, and AI vendor contracts.
Practical governance programs an already-stretched security team can actually run.
Weekly dispatch
Weekly insights on shadow AI, regulatory updates, and enterprise governance — from the Draxion team.
From reading to evidence
Every briefing above describes a problem Draxion measures directly. See it against your own organization instead of ours.
Written by the team that builds the platform. Published weekly.