Technical reports and citable frameworks.
Longer-form work in a form a board paper, procurement file or literature review can cite. Each piece is deposited on Zenodo with a DOI, free to reuse for non-commercial purposes, with its sources stated in full.
Six reports, each with a DOI.
Each report adapts an article first published on this site. The executive summary becomes the abstract, the sources become a numbered reference list, and the PDF is fixed once deposited. If an article is later corrected, a new version goes up under a new DOI rather than being edited in place. These are practitioner reports, not peer-reviewed papers, and each says so on its title page.
AI Companies Actually Printing Revenue in 2026
Strip out cloud infrastructure revenue (AWS, Azure, Google Cloud) and strip out AI features bolted onto software that was already selling before generative AI existed (seat-priced copilots, assistant add-ons), and a much smaller, much more interesting list remains: AI-native companies whose entire revenue depends on the AI output itself, in legal work product, clinical documentation, resolved customer tickets, shipped code, generated video and voice. These companies exist and several are now doing hundreds of millions to billions in annual recurring revenue. What they share is how they charge, not their category.
Cite as Kok, T. (2026). AI Companies Actually Printing Revenue in 2026. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685620
The Black Box Problem and How to Engineer Around It
The black box problem is not one problem. Jenna Burrell’s 2016 taxonomy separates opacity that is withheld, opacity nobody has the expertise to read, and opacity that exists because no one, including the model’s own developer, can hold the explanation. Only the third form is intrinsic to the technology, and it is the one that produces silent failure, unfaithful self-explanation, and safety arguments that become statistical rather than deductive. The workable response is not to wait for interpretability to mature. It is to constrain what an opaque component is permitted to decide and instrument the system around it so failure is caught from outside.
Cite as Kok, T. (2026). The Black Box Problem and How to Engineer Around It. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685582
The Need for an AI Stability Board
Every institution built to manage a global risk, nuclear proliferation, systemic financial contagion, ozone depletion, took shape after a body with standing to act was formed. AI governance has run the sequence backwards: three summits in three years, an advisory body with no enforcement power, and a retreat from the word “safety” itself, while frontier models cross capability thresholds the summits were convened to watch for. A stability board for AI would not regulate deployment. It would do what the Financial Stability Board does for finance and the IAEA does for nuclear material: hold the common risk picture, run the independent evaluation, and raise the alarm before a national regulator can.
Cite as Kok, T. (2026). The Need for an AI Stability Board. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685600
Outcome as a Service: What the Contract Has to Do
Outcome as a Service is sold on the claim that it moves 100 per cent of delivery and performance risk to the vendor. Sixty years of performance-contracting history, from Rolls-Royce’s Power by the Hour to modern energy savings contracts, says risk is redistributed rather than removed. Three categories of exposure, statutory duty, retained control over client-side variables, and second-order cost, stay with the buyer no matter how the invoice is structured. Contracts drafted on the opposite assumption fail in a predictable, well-documented way.
Cite as Kok, T. (2026). Outcome as a Service: What the Contract Has to Do. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685614
What Stops a Rogue Agent You Never Catch
“Rogue agent” sounds like science fiction, a system that decides to defect. The evidence from 2026 says the real version is quieter than that: agents that conceal ordinary self-interest from the exact mechanism built to catch them, or agents that never intended anything adversarial and still escalate into sabotage because nobody gave them visibility into each other. Human-in-the-loop only works when the loop sees the right thing at the right time. This report is about what holds when it does not.
Cite as Kok, T. (2026). What Stops a Rogue Agent You Never Catch. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685618
Singapore Small Business AI Use Tripled to 14.5%: Why the Other 85.5% Are Still Behind
AI use by Singapore small businesses tripled between 2023 and 2024. But the gap with bigger companies got wider. The problem is not that small businesses do not want AI. IMDA’s own data shows 95.1% of small businesses already use at least one digital tool. The problem is picking AI projects that work for a business with no IT team, and knowing which ones do not.
Cite as Kok, T. (2026). Singapore Small Business AI Use Tripled to 14.5%: Why the Other 85.5% Are Still Behind. Technical report. Zenodo. https://doi.org/10.5281/zenodo.22685622
How the controls fit together in a real pipeline.
Where the frameworks say what to check, a reference architecture says where each check sits, which component gives effect to which control, and what the audit log has to contain. Every design rule is traced to published guidance.
Six frameworks, versioned and citable.
Each framework page carries a reference diagram, a version number, first-published and last-revised dates, a suggested citation and a PDF brief. The brief is deposited on Zenodo with its own DOI, so a framework can be cited the same way as a report. The Readiness Assessment, TRACE, the Governance Baseline and the reference architecture's control set are also published as machine-readable YAML, templates and a JSON Schema in the open ai-governance-toolkitrepository under CC BY 4.0, for use in governance registers, policy engines and procurement templates.
How to use this research.
Everything on this page is licensed CC BY-NC 4.0: reproduce it with attribution for non-commercial use, including internal board papers, training material and academic work. For use in a commercial product, a paid course or a tender submission, write to me; permission is normally a formality and I would rather know where the work is going.
Corrections are welcome. Every report states its sources; if one is wrong, the article version is corrected first and the deposit superseded. Credentials, patents and the full record →
I started depositing these for a plain reason: a blog post, however careful, is not something an evaluation committee or a literature review can cite with a straight face, and a DOI is. The reports are the same arguments the articles make, with the furniture removed and the sources numbered, and every title page says what they are and are not. If one helps you win an argument you should have won anyway, that is what it is for.
