Chatbots became copilots, copilots became agents, and agents acquired credentials, tool access and the ability to act on systems of record. Data now moves through normal, correctly-functioning AI operation in ways conventional controls were never designed to see.
A practitioner's field guide that brings the technical, privacy, regulatory, governance and operational dimensions of enterprise AI risk together in one place — with a control library, a ninety-day plan and checklists you can take to work.
Digital PDF · download page opens straight after payment
Ask an internal assistant to summarise the quarter's underperforming accounts and it retrieves from half a dozen repositories, assembles a context window and returns an answer. No file moved. No perimeter was crossed. No DLP rule fired. Yet a synthesis of material the employee may never have been entitled to see has just been created and delivered.
Fragments from many sources combine into a single answer more sensitive than any one of them. Per-document classification does not capture the combination.
A model reads its instructions and the content it processes through the same input, with no reliable structural means of telling them apart.
The same input can produce different outputs. Testing establishes a distribution of behaviour, not a guarantee — so "it passed the test" does not transfer.
Once a model can call tools, its output stops being text and becomes an instruction to a real system: a database write, an email, a payment, a deployment.
Chapter 1 sets out the cost data and reads the governance signal inside it. The organisations paying the premium are, in the main, the ones that deployed AI faster than they governed it.
Global average cost of a data breach in 2026, up 12% on the prior year.
Malicious breaches were AI-enabled — a 56% increase year on year — costing roughly USD 6M.
Share of breached organisations with incidents involving unsanctioned AI tools, year on year.
Source as cited in the book: IBM Security & Ponemon Institute, Cost of a Data Breach Report 2026. Figures are associations across cohorts, not controlled causal estimates.
Five parts: why AI breaks the assumptions behind conventional data security, the threat landscape, privacy as a distinct discipline, the regulatory and standards landscape, and the conversion of all of it into controls.
The OWASP Top 10 for LLM Applications and what changed in 2026 — prompt injection, sensitive information disclosure, excessive agency, supply chain — plus where that list stops. Shadow AI as an ungoverned perimeter, and the retrieval layer's permission-loss problem.
Six case files of documented failures, and the pattern across all of them.
What changes when a model can act: the identity problem for non-human actors, designing for containment, and the connector and protocol surface.
Tool scope · credentials · approval gates · step and spend ceilings · memory isolation · kill switches.
Why security controls do not discharge privacy obligations. Lawful basis and the training question, purpose limitation and function creep, transparency, data subject rights against an AI system, and accuracy where the system fabricates confidently.
Privacy-enhancing technologies: the categories, choosing one, and a realistic assessment of each.
The EU AI Act, India's Digital Personal Data Protection framework, data protection law generally, and the United States. Cross-border transfer, sovereign and regional AI, and sector-specific overlays.
NIST AI RMF and ISO/IEC 42001 — how they fit together, and what none of them cover well.
The accountability question, the four artefacts, the lifecycle gates, and risk tiering so the process survives contact with delivery teams.
Inventory · assessments · control evidence · governance forum with decision authority.
The control library, the first ninety days, vendor due diligence and contracting, and incident response for AI systems from preparation through notification and recovery.
Plus a glossary, board questions, checklists, a regulatory calendar and a sources appendix.
Every chapter closes with a short set of deliberately concrete actions. Part V is a reference layer: a structured control library organised by the layer each control operates on, each one carrying a priority and a test.
The book's own instruction: test each control rather than declaring it. A control you cannot demonstrate under test is a control you do not have.
Days 1–30, see the estate. Days 31–60, close the loudest gaps. Days 61–90, build the system that persists — plus what to do differently if you are further along.
Where AI enters through procurement, the due diligence questions to ask, terms worth insisting on, and how to assess open-weights and self-hosted options.
What an AI incident looks like, then preparation, detection, containment, investigation, notification, recovery and learning.
Appendix B — questions phrased for an executive risk committee, each with a right answer that is a document rather than a reassurance.
Appendix C collects the operational material into checklists — a pre-deployment list, an operating cadence, and the five tests that find the most.
Abridged from Appendix C
It assumes no prior background in machine learning. It does assume you are responsible for something.
You need the AI-specific delta: what is new, what is different, and which controls actually address it. Parts II and V are written for exactly that read.
Part III treats privacy as a discipline separate from security — lawful basis, purpose limitation, subject rights and assessments against systems that do not hold data the way older ones did.
Every control in the library carries a test, which is what an audit programme needs. Tiering criteria, evidence and lifecycle gates are set out explicitly.
Chapters 2, 5 and 6 go layer by layer: where enterprise data enters and leaves, retrieval authorisation, hidden context, tool scope and agent containment.
Chapter 13's operating model, the framework mapping across NIST AI RMF and ISO/IEC 42001, and the artefacts that make accountability demonstrable.
Appendix B gives ten questions that surface the real state of a programme, each with a right answer that is a document rather than a reassurance.
Not written for: readers looking for an introduction to AI, a prompting guide, or a machine learning textbook.
The book is educational material, not legal advice. Regulatory obligations depend on your jurisdiction, sector, corporate role and the specific systems you operate.
Appendix E lists the primary sources by subject. The book states its own position clearly: figures, framework versions and regulatory dates reflect the position as at August 2026, and three areas — the OWASP GenAI lists, the Commission's implementing guidance, and India's phased DPDP commencement — were under active revision at the time of writing.
These organisations are cited as primary sources within the book. No endorsement of, or affiliation with, this publication by any of them is implied. Product and vendor names appear in the book only as illustrations of documented incidents or categories.
Author · First edition, 2026
Naman Jain is a Chartered Accountant and A.I consultant with a growing interest in Artificial Intelligence and its impact on modern businesses. He explores how AI is transforming enterprise operations, risk, governance, data security and decision-making, with a particular focus on making emerging AI concepts practical and relevant for professionals and organisations.
The book states its own scope plainly: it is written for the people responsible for holding the line as AI moves into production, it assumes no prior background in machine learning, and every figure it cites is traceable through the sources appendix.
A Practitioner's Field Guide · Naman Jain
After payment you are returned to a download page where the PDF is available immediately.
Naman Jain
Security leads, privacy and compliance officers, risk and audit professionals, data and platform engineers, AI governance professionals, and the executives who sign off on AI programmes.
No. The book states that it assumes no prior background in machine learning. It does assume you are professionally responsible for something — a system, a control, a programme or a sign-off.
No. There is no code and no model training material. It is architectural and control-oriented: where data flows, where authorisation must live, what to test, and what to write down.
Yes — a chapter each. Chapter 5 covers RAG, vector stores and permission loss, including where the control must live. Chapter 6 covers agentic AI: identity, containment, and the connector and protocol surface. Control groups D and F carry the matching controls and tests.
Yes. Chapter 10 covers both, along with data protection law generally and the position in the United States. Appendix D is a consolidated regulatory calendar with the maximum penalties for reference. Dates reflect the position as at August 2026 and the book advises verifying against primary sources.
Yes. A control library organised in eight groups, each control with a priority and a test; a ninety-day roadmap; vendor due diligence questions and contract terms; an incident response sequence; ten board questions; and Appendix C's pre-deployment checklist, operating cadence and five tests.
No. The book is educational material. It states plainly that regulatory obligations depend on your jurisdiction, sector, corporate role and the specific systems you operate, and that you should engage qualified counsel and your regulator's published guidance before making compliance decisions.
A 78-page digital PDF. The flow is: payment on the gateway, automatic redirect to a thank-you page, download from there.
AI systems read what they are permitted to read, act within the scope they are given, and produce confident output that people and other systems act upon. This field guide sets out how to control the reading, the scope and the output — in one place, with the tests to prove it.
Get this eBook{{ priceLabel }} · digital PDF · download page opens straight after payment