Six months of reading on applied AI for organisations, condensed: AI value comes from governed, embedded, process-redesigned deployment; the law sets the boundary and the deadline; agents move the binding constraint from "can we trust the output" to "can we trust the system with authority to act".

Browse by domain in 00-map. Every claim below links to a rated source (A–E credibility; ⚠ marks contested dates).

The ten things the corpus agrees on

Pick the kind of AI first. Rules, classical ML, deep learning, generative AI and agents solve different problems and carry different risk; the application area sets the legal tier (d1-foundations-technology, d8-regulation-policy).
The organisation, not the model, decides success. Process redesign, sponsorship, operational excellence and change management explain the gap between pilots and scaled value (enterprise-ai-playbook, mckinsey-scaling-ai-roi-operational-excellence, brynjolfsson-hitt-2000-beyond-computation).
Only a minority scale. Roughly 7% of organisations run AI enterprise-wide and ~12% have it embedded in the flow of work; those that do report markedly higher margins and returns (mckinsey-scaling-ai-roi-operational-excellence, hbr-the-agentic-enterprise).
Governance is a running engine: inventory → classify → assess → control → monitor → assure, with one register and a named owner per system — not a policy document (ki-governance-funktion-aufbau, govern-manual-2026, pic-4-tests-ai-governance-works).
Agents need a pre-action checkpoint and runtime controls: identity, permissions, disposition, audit log, kill switch, drift detection, escalation (pic-mas-safr-components, aus-multi-agent-risks-controls, pic-agentic-governance-is-vs-think).
The EU AI Act is the apex of a converged legal stack (GDPR, NIS2, DORA, CRA, DSA). Prohibitions and GPAI duties are in force; transparency duties apply from August 2026; High-Risk obligations now apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744, in force since 27 July 2026 — verified against EUR-Lex (web-eu-reg-2026-1744-digital-omnibus-ai, patel-eu-ai-act-amendments-visual, eu-regulatory-convergence-crisis).
Risk is diffuse, responsibility is concentrated; frontier-lab self-governance scores C+ at best, so external verification and organisational controls carry the weight (mit-prioritization-of-ai-risks, fli-ai-safety-index-summer-2026).
Data readiness is the real prerequisite: diverse, timely, accurate, secure, discoverable, consumable data with a semantic layer and lineage; classify what AI may touch in five tiers (qlik-six-principles-ai-ready-data, data-modelling, pic-ai-data-classification-5-tiers).
Cyber resilience is the floor: frontier AI compresses the exploit window; Zero Trust and NIS2/DORA controls extend to agents as non-human identities (asic-frontier-ai-cyber-resilience-2026, microsoft-blaupause-cyberresilienz, anthropic-zero-trust-ai-agents).
Work changes by task, not by job. Automation displaces routine tasks, new tasks reinstate labour; AI can extend expertise if deployed as augmentation; the scarce skill is asking the right question (acemoglu-restrepo-2019-automation-and-new-tasks, autor-2024-applying-ai-rebuild-middle-class-jobs, ai-answers-vs-thinking-beyond).

The Falcon delivery model (consolidated from the corpus)

Seven areas on one spine, with a central engine and a maturity rail; documented in 01 Workflows/01 Reports/Falcon-AI-Governance-Framework.html (own work, June 2026):

Area	Covers	Domains
01 Strategy & operating model	risk appetite, CAIO/CoE/steering committee, three lines of defence, maturity	D2, D3, D7
02 Risk, ethics & trust	taxonomy → heat-map → quantified register, responsible-AI values	D5
03 Regulation & compliance	EU AI Act tiers and timeline, ISO 42001, NIST crosswalk, FRIA/DPIA	D8, D7
04 Data, architecture & model governance	inventory, data architecture and semantic layer, lineage, model registry	D1
05 Operations, security & guardrails	MLOps/AgentOps, guardrail pipeline, HITL/HOTL, zero trust, incidents	D4, D6
06 Agentic AI governance	autonomy dial, agent identity, commit layer, safeguard layers, AI-BOM	D7, D5
07 Value, people & adoption	use-case gate, KPI families, cost/token control, literacy, change	D2, D3

Central engine: inventory → triage & classify → assess → control → monitor → assure & report. Six-phase playbook (the service map): inventory, classify, govern, document, monitor, prove — 16–26 weeks from zero to audit-ready.

What is contested or thin

EU AI Act dates, US EO 14365, California SB 53, Colorado SB 26-189 (effective 1 Jan 2027) and Korea's AI Basic Act were confirmed by the 2026-10-20 research pass; China, India, Japan, Brazil rows of the policy map remain unverified.
The "95% of pilots fail" figure; vendor ecosystem maps; infographic statistics without citations.
Thin domains: cyber security (4 sources), organisation & work (9), strategy (13).

How this base is kept honest

Every source page carries credibility (A official/standard · B peer-reviewed · C institutional · D practitioner · E social media), accuracy (verified / plausible / contested / outdated) and an evidence_note; the inventory maps every original file to its page; .scripts/build_inventory.py --check lints links and ratings.

Related

00-map · index · inventory · frameworks-from-trainings · learning-plan · log