Insights · October 19, 2026
By Mason Hughes
Every firm selling AI says it takes safety seriously. Very few show what that looks like on a normal Tuesday. This is ours: the commitments we hold our own system to, and the record that shows whether we keep them.
MAIDEN runs its own business on the Business Artificial Intelligence Briefcase, the same patent-pending, ISO 42001-aligned system our client work builds toward. Everything below describes how it runs for us today.
Our data never trains someone else's model. We do not put internal data or intellectual property into any model that learns from it. Every model we use runs with training on our data turned off.
Our most sensitive records are walled off from AI entirely. Legal and confidential business records sit in protected folders the AI cannot read, search, or reason about. That boundary is enforced by the system itself, not by an instruction the AI is asked to follow. If a request would touch a protected folder, it is blocked before it runs.
A person approves what matters. Anything that reaches a client, changes how the system is configured, or adds a new connection waits for a clear yes from a person on our team. A vague answer does not count as approval.
Every action leaves a record. Each action the AI takes is written to an audit log as it happens. At the end of a working session, that record is sealed and kept as permanent evidence that cannot be edited afterward.
We keep a risk register of 41 known AI risks, each with an owner, a mitigation plan, and a review date. They cover everything from a model provider changing its terms to an AI stepping outside its assigned job.
When the system blocks an action that crosses one of those lines, a separate safeguard logs the incident automatically: what was attempted, which risk it falls under, and when. The two work in tandem, one stopping the action and one recording it, so nothing depends on someone noticing and remembering to write it down. The AI can also log an incident on its own when it catches its own mistake, but that is never the only line of defense. The automatic record is always running underneath.
From there, every incident gets a corrective action report: the root cause, what changed, and who closed it. Sometimes the fix is a rule change. Sometimes the block was correct and the record simply confirms the guardrail held.
42,500 AI actions in the first six months, at 99.96% accuracy.
17 defects in that output. Twelve were caught and corrected mid-process. The other five were corrected with a person in the loop before anything live was affected.
Under a day average incident close time. Four in five are closed the same day they are caught.
The defects are mistakes in the work itself. Incidents are the moments a safeguard stepped in, and closing them fast means every one gets a root cause and a correction while it is still fresh.
Businesses adopting AI are being asked, more and more, what they would show an auditor, a client, or a partner who wants proof. We would rather show it before anyone asks. This is the standard we build into every client engagement, and the same one behind our Run / Maintain / Improve support. We will keep reporting against it.
If you want to see where your own operation stands, start with the Operational Audit: 20 questions, 5 minutes.
20 Questions · 5 Minutes
45 Minutes · Free