AI in the SOX 404 Control Environment: What Your Auditor Is Likely to Ask
An AI step in a finance process becomes part of internal control over financial reporting. What the SEC's rules say, and the evidence to have ready for audit.
ReadInsights
What we're seeing in regulated operations: the rules, the economics, and what happens in the field.
Regulation explained
What a rule actually requires, and the decision it forces on you. Plain language, dated, not legal advice.
SR 26-2 Replaced SR 11-7. Here Is What It Says, and Leaves to You, About AI.
SR 26-2 replaced SR 11-7 in April 2026. It leaves generative and agentic AI outside its scope. What the guidance says in its own words, and what banks can do.
Read"The Model Said No" Is Not a Reason. What Regulation B Asks of an AI Credit Decision.
Regulation B says a denial must give specific principal reasons, and a failed score is not one. What the rule and its commentary ask of lenders using AI.
ReadHIPAA in the Cloud Isn't a Checkbox: What HealthTech CTOs Actually Need
Using AWS doesn't make you HIPAA compliant. Here's what HealthTech CTOs actually need to know about cloud compliance - from BAAs to audit trails to the gaps most teams miss.
ReadThe SOC2 Shortcut That Isn't: Why Compliance Requires Systematic Process
Every startup wants the SOC2 shortcut. Here's the uncomfortable truth: shortcuts create compliance debt that costs far more to fix later than doing it right now.
ReadIOanyT Academy lesson
Liability is real: Air Canada and beyond
Why a business answers for what its AI tells customers: the reasoning in Moffatt v. Air Canada, and what reasonable care looks like for AI answers.
Open lessonIOanyT Academy lesson
AI washing: what regulators have penalised
SEC and FTC actions over false or unsubstantiated AI claims, from Delphia and Global Predictions to DoNotPay and Workado, and how to back up your own.
Open lessonIOanyT Academy lesson
EU AI Act basics for buyers and builders
The EU AI Act's risk tiers, the 2026–2028 dates after the Digital Omnibus agreement, what high-risk systems must show, and where deterministic logic helps.
Open lessonOperations economics
What a system costs to build and to run, where the money goes, and when automation will not pay.
Cost per Case: The Number Missing From Most AI Business Cases
AI business cases count hours saved and licence fees, rarely the cost of one completed case. What the record shows, and the number finance should see.
ReadA Cloud Cost Audit Playbook That Finds Real Savings
Most cloud cost advice is generic and useless. Here's a concrete, step-by-step cloud cost audit playbook that finds the real money hiding in your AWS bill.
ReadWhy Your Startup's First AWS Architecture Decision Is the Most Expensive One
Early architecture choices compound for years. Here's how to avoid the five most common AWS mistakes that cost startups $100K+ in rework - and what to do instead.
ReadThe Vendor Lock-In Myth: Why Multi-Cloud Often Costs More Than It Saves
The fear of AWS lock-in drives companies to multi-cloud strategies that cost more and deliver less. Here's when lock-in is real—and when it's an excuse.
ReadWhat Your AWS Bill Is Actually Telling You
Your AWS bill isn't just a cost report. It's a diagnostic tool revealing architecture decisions, team behaviors, and hidden waste. Here's how to read it.
ReadIOanyT Academy lesson
Cost math: compiled vs runtime LLM
How to compare the cost of calling a model on every transaction with compiling the logic once: per-case cost, break-even volume, latency and change rate.
Open lessonField notes
What we see on real work: diagnoses, what we advise against, and the engineering lessons behind them.
Consistency Is Not Correctness. Test Both Before an AI Workflow Goes Live.
An AI workflow can be repeatable and still wrong. What the record shows on run-to-run variance and AI answers in court, and the two tests to run before go-live.
ReadFrom Policy Document to Rules You Own
Policies live in documents that people and AI read differently. Why the source of a decision matters, and how a policy becomes rules you own, clause by clause.
ReadThe Stalled Claims-Triage Pilot: Which Steps Should Never Have Used a Language Model
Why claims-triage pilots that give one model every job stall, and which steps should use a model, which should run on approved rules, and which need a person.
ReadWhen Not to Automate: How to Tell Which Work to Leave Alone
Could be automated is not should be. What the record shows about handing work to AI, and the signs that a step is better left with people or simple rules.
ReadIOanyT Is Now ISO/IEC 42001 Certified
IOanyT Innovations is now certified to ISO/IEC 42001, the international standard for AI management systems. It covers how we build and govern AI ourselves.
ReadThe Pre-Acquisition Code Audit Most Buyers Skip
Buyers scrutinise financials and legal, then inherit the software blind. Here's the pre-acquisition code audit that reveals what the spreadsheet can't.
ReadResearch notes
Sector research: the regulator’s position and what the public record says about firms in the same situation.
The Rules Your Results Application Applies Keep Changing. Four Ways to Make a Change You Can Check, Weighed.
A results application is changed as courses and regulations change, and nobody can say what else moved. Four answers weighed, and what each one risks.
ReadA Replacement Plan Needs Stages Someone Can Check. Here Is the Benchmark We Would Set.
One completion date gives a board nothing to check. The benchmark we would set for a staged replacement plan, with evidence at each stage.
ReadHow Much of What Care Rests On Have You Mapped? Four Measures, Now and Where They Should Be.
How many of the applications your care rests on are mapped, ranked by clinicians, written down or out of support? Four measures, where they start, the path.
ReadHow Much of Your Own System Do You Hold? Four Measures, Now and Where They Should Be.
When a supplier built your hospital's system, it holds the only description. Four measures of what you hold, where they start and should be, and the path.
ReadThere Is No Newer Version to Move To. A Software Firm Does Not Have to Stop Selling to Leave.
When a product's technology has no supported version left: what buyers' and makers' rules now ask, four ways out, weighed, and the one we would recommend.
ReadYour Product Still Has a Data Store From Its First Version, and It Is on Nobody's List. What the Firm Lacks Is a List Taken From the Code.
A product that has run for years keeps data in stores nobody remembers. What we found, why memory falls short, four ways forward and the benchmark we set.
ReadIssue studies
Public cases, studied from the record: the decision at stake, the options, and the benchmark we would set. IOanyT did not work on these cases; each is drawn from published findings.
Issue study · From the public record
Priced Before It Was Read
What replacing old student and finance systems has cost large universities, from the public record: the options, what we would advise against, our benchmark.
Education
Issue study · From the public record
Strongly Recommends That You Replace
Software products on technology its maker no longer supports, from the public record: published support dates, the rules, the options and our benchmark.
Software and SaaS vendors
Issue study · From the public record
Ten Months Without New Customers
What the RBI named when it restricted a bank's new business over IT, from its own releases: the options, what we would advise against, and our benchmark.
Banking
Issue study · From the public record
The Rules Inside a Results Application
Slow or faulty results processing, from the public record: the rules inside an institution's own results application, the options, and our benchmark.
Education
Issue study · From the public record
The Store the Product Stopped Using
Old data held in stores a software product no longer uses, from the public record: what the code shows, the options, what to avoid and the benchmark we set.
Software and SaaS vendors
Issue study · From the public record
When the Laboratory's Supplier Stops
Hospitals stopped by an outside supplier's failure, from the public record: what is in a hospital's own hands, the options, what to avoid, and our benchmark.
Healthcare
Newsletter
What We Advised Against
The AI and legacy-system changes we recommended not making, why, and what we suggested instead. A short read every other Monday.
Subscribe on LinkedInHave a decision like these in front of you?
Bring one AI pilot or workflow to a free Reliability Review. You leave with a 2-page note you keep.
Book a Reliability Review