Went for AI training that only teaches you to prompt, or use a tool?
I call these “prompt and pray” courses. Spend a day or two. Leave with a few tricks that break the moment the tool evolves, and no idea why.
This is my experiment to do the opposite: no jargon, materials in plain language that teach you mental models and how AI actually works, so what you learn transfers to the next tool and the next model.
For folks who want a first principles understanding of AI, AI governance and risk management, in finance and other domains. From someone who has built AI models from the ground up and written national-level rules for how they should be governed.
Books first. Courses and more are coming. Some free, some paid, all affordable.
Start Here
New to this, or not sure my way of explaining things works for you? Start here. These cost nothing.
Short, plain-English primers on AI, governance, and risk. Each is a fast way into a topic, with a fuller book behind it. From the author of the MAS AI Risk Management Guidelines (AIRG).
You want to get on top of AI risk and governance, but where do you even start? Search Google or Perplexity and you get more results than anyone can reasonably read - most of it noise, much of it vendor pitches. It is easy to spend hours and come away with nothing.
This book is the answer I keep giving when people ask. Six short reading lists of papers, guidelines, and articles - governance, data management, evaluation and testing, human oversight, third-party AI risk, and explainability - each entry with a note on why it is useful and worth your time. Organized in circles of progression: start at the center and work outwards. Read the one you need; nothing here assumes you read the others.
What you get: a clear, curated path through a noisy field, so you can start on the right things instead of drowning in search results. No affiliate links, no vendor pitches - just what is worth reading in each area, from someone who wrote a national set of AI risk guidelines and has read most of the rest. Work through it and you will understand AI risk better than most people paid to talk about it.
Not exhaustive, but a good place to start.
For the finance-focused version kept most current, see the AI risk management resource list.
https://quaintitative.com/ai-risk-management-finance-resources/
I call it "prompt and pray." A workshop, a demo, a clever prompt, everyone marvels - and no one stops to ask what the model is actually doing, what data it's seeing, what task it thinks it's solving. This primer is the opposite: the boring fundamentals that outlast every model launch. The frame is three questions. What data do I have? What task am I doing? Which method fits? Around them, four short moves. An AI model is just math - form, loss, train, evaluate, the same four questions under a line through points, a neural network, an LLM, and an agent. The shape of your data decides what follows - five data types, one grid, very different structures. The magic wand conceals a toolbox - every AI project is a chain of named tasks from a small set of families. And machine learning, deep learning, generative AI, and agentic AI are four setups over the same three parts. About 30+ pages, in plain English. Written by someone who started a PhD in AI at 42 after years of managing investment risk, and wrote Singapore's AI risk guidelines - for anyone who wants to understand what they're looking at before reaching for a model. This is the gateway to the full book, *Thinking in AI*, which takes the frame through each of the five data types in depth - why a small model on a spreadsheet still beats billion-parameter models at most real decisions, how a five-step language pipeline collapsed into one model, why your ECG and a stock chart are the same kind of problem. Free to download, and free to pass along.
For how this underpins AI risk management, see AI risk management, explained.
Someone will try to sell your organisation AI governance that looks impressive - an ethics framework, a principles workshop, a thousand-question checklist. Most of it won't actually manage anything. This primer is about another view: not AI governance principles, but the underlying first principles of AI risk management.
Part one is the AI. One idea - a line through points - scaled up from machine learning to deep learning, language models, RAG systems, and agents. Every step up buys more capability and more of the three U's: uncertainty, unexpectedness, unexplainability. No equations, no code - just the mental models, including why language models make things up, why testing once tells you little, and why the sensible architecture is often the boring one.
Part two is the risk management. The whole framework fits on a napkin: what do you have, how are you managing it, who's accountable. Then one level down - the system that answers those questions as a cycle, the lifecycle controls in 3 groups, and why the controls only work together, as a system, not a checklist.
Written through the financial sector's risk lens by the author of Singapore's AI risk management guidelines, but built to work for hospitals, hiring, and government services too. About 36 pages.
This primer is the gateway to the full book and guided course - AI Risk Management from First Principles - planned for 4Q 2026.
For the whole picture in one place, see the complete guide to AI risk management in finance in Singapore.
https://quaintitative.com/complete-guide-ai-risk-management-finance-singapore/
You sit across the table from firms whose models you did not build and cannot see inside. This primer is how to judge them anyway, in a few simple questions: one consistent approach, a net that catches AI as it enters, an inventory that things actually depend on, evidence tested to the firm's own task, controls that work as a system, and a deliberate decision about where fast is safe. It closes with the three places firms hide risk from you - the low rating, the inventory gap, and oversight on paper - and a start you can make on your next visit: ask for the full inventory, pick three systems rated low yourself, and ask why. Written by the person who led AI risk supervision at the Monetary Authority of Singapore and developed Singapore's AI risk management guidelines for the financial sector. Nothing in it depends on which instrument your regime anchors on. About twenty pages, written simply, and deliberately boring. This primer is the gateway to the full book, *AI Risk Management for Regulators and Supervisors* (listed here separately), which works each question in depth - what you are actually assessing, where firms hide risk, proportionality, the inventory and the rating, the controls before and after go-live, third-party AI, and capability on both sides of the table. If this primer was useful, pass it along.
For the supervisor's view and how this fits, see AI risk management for regulators and supervisors. https://quaintitative.com/ai-risk-management-for-supervisors/
Someone will try to sell you an LLM that predicts the future. It will sound confident, and it will be wrong more often than it lets on. Forecasting is usually the AI task most oversold and least understood. This free primer provides some mental models to understand why. Why a language model cannot forecast on its own - text and time are different kinds of sequence. What actually forecasts: the ladder from fifty-year-old classical models that still win competitions, through machine learning and deep learning, to the foundation models trying to become the ChatGPT of time. And why one rational way to use AI here is with an agent - a reasoning loop that drives real forecasting tools and checks the results against reality. No code, no notebooks, no math you need a whiteboard for. You also leave with a working detector for nonsense: the questions that separate a real forecasting system from a confident paragraph - was it backtested, was the test split by time, did it beat the naive baseline. Written by someone who did a PhD building forecasting models and wrote Singapore's first AI risk management guidelines for the financial sector. The upcoming companion, *AI Agents for Advanced Forecasting*, builds everything here in code - the tools, the agent patterns, runnable notebooks - and is targeted for 4Q 2026. This primer is the why. Free to download and keep.
For the risk-aware view, see the risks of AI forecasting.
An agent is not a chatbot with a new name. It acts - it looks up accounts, issues refunds, sends emails - and each choice opens more choices, until nobody can review every path. A simple billing-dispute agent has thousands. This primer is one picture to think with: the agent as a tree of paths, governed the way a bonsai is tended. Cut, and wire. Cut the branches that must never happen - the permission that was never granted cannot be argued with, tricked, or talked past. Then hold the rest with 3 kinds of wire. Rigid wire: rules coded into the tools, not prayers written into the prompt. Supple wire: a model posted as judge - useful, and a second tree you now have to govern. And your own hands: evaluation and testing that reads the path instead of the answer, repeats every run, and probes through everything the agent reads. Along the way: why 95% reliability per step becomes 60% over ten steps, why a rule in the prompt is a request while a rule in the tool is a control, why fluent wrongness passes a fluency check, and the sign-off questions that cannot be answered with adjectives - show me the trajectories; what happens if the model ignores this control; what is the success rate across 8 repeated runs? About 40 pages, with figures for nearly every idea. Written by the author of Singapore's AI risk management guidelines and deliberately general: the ideas apply to agents anywhere, not just in finance. This primer is the gateway to the fuller book - *AI Risk Management: Agentic AI*, the supervisory expectations, registers, evaluation practice and worked examples behind this way of thinking - planned for 4Q 2026.
For the fuller picture, see agentic AI risk management. https://quaintitative.com/agentic-ai-risk-management/
Someone asks me, or I ask myself, where to even start with learning AI. Search and you drown - a thousand courses on prompting a chatbot, and almost none on how any of it works. This is the answer I keep giving. The handful of resources that actually taught me AI, from the years I taught myself the basics and then did a PhD in it, roughly 2015 to 2023, before the ChatGPT hype. Grouped by what they are good for: the on-ramps like Andrew Ng and fast.ai, the books worth keeping on the desk, the explainers for when a concept will not click, and the deeper corners by the shape of your data. Each entry has a note on why it is worth your time, and an honest opinion on which to do first. Almost everything here predates LLMs and still holds, because the fundamentals move far slower than the headlines. A course from 2017 will still teach you more about how AI works than a viral post on ten things a chatbot can do. What you get: a curated path through a noisy field, from someone who learned it the slow way and now teaches it. The PDF to download and keep, free.
For where this leads in finance, see the complete guide to AI risk management in finance.
https://quaintitative.com/complete-guide-ai-risk-management-finance-singapore/
Agreeing that AI should be fair, reliable, and safe is easy. You still need evidence. This primer gives you the 8 questions to ask of any AI system, in one sitting: why did the model produce this result, does it treat groups differently, is the output good enough, how does it fail when someone tries to misuse it, what checks can prevent harm while it's running, what is it doing once people use it, what changes when it can take actions, and what evidence does someone need to approve it.
It closes with a start you can make this week: pick one system you're responsible for, work through the questions, and write down the gaps.
Written by the person who led quantitative model risk inspections and AI risk supervision at the Monetary Authority of Singapore, and wrote Singapore's AI risk management guidelines for the financial sector. About a dozen pages, deliberately boring.
This primer is the gateway to the full book, Boring Questions for AI Lifecycle Risk Management (listed here separately), which works each question in depth - what it means, what to look for, and the open-source tools to start your learning journey. If this primer was useful, pass it along.
Someone will try to sell you an LLM that manages your money. It will sound confident. Some of it will be made up, and it will not tell you which parts. This primer is about why that happens - an LLM on its own has no data and no calculator - and about the fix, which is not a smarter model. It is the right architecture. Five ideas, in about twenty-five pages. LLMs are buns, not meat: good at the language, not at the numbers. Most tasks don't need an agent - the complexity ladder tells you when a workflow will do. An agent is four parts - model, tools, instructions, memory - holding three kinds of tools, and only one kind should ever act without a human. Four patterns cover the work: tool calling, ReAct, CodeAct, orchestration. And the demo is not the product - the gap to production is guardrails, approval, and audit, not cleverer models. No code, no notebooks. Written for anyone who will buy, build, or approve an AI tool that touches a portfolio - and who wants to be able to tell, when shown one, whether it is calling real tools or generating a confident paragraph. This is the primer to the full book, *AI Agents for Investing* (listed in this catalogue), which builds all of it in runnable code: the tools, the four patterns, a working portfolio assistant, and a no-code path for people who would rather not write Python.
For the risk-aware view, see the risks of AI investing.
Most of what passes for AI governance is a pile of boxes that grows faster than the AI does - and never quite governs it. Multiply it out: twenty frameworks, two hundred use cases, a thousand questions per checklist. Four million boxes. Even if you ticked them all, you still wouldn't be governed. You'd just be really really busy.
This primer is the opposite argument, in three moves, written by the author of Singapore's first AI risk management guidelines for the financial sector. For anyone trying to keep control of AI as the number of systems climbs, in a firm, a regulator, or a team of one.
This primer is the gateway to the fuller book, Some Thoughts on Scaling AI Governance.
For the fuller picture, see governing AI at scale.
You have been handed AI risk. The business ships faster than you can review, the frameworks keep multiplying, and the checklists the consultants sell map to everything and manage nothing. This primer is the answer in six questions, read from the second line's seat. Consistency first, org chart second. Own the net that catches AI as it enters, then go to the low-rated. Make the inventory the command centre. Test to your task, not their benchmark. Run a system, not a checklist. And decide where fast is safe. It closes with the three places risk actually hides from you - the low rating, the inventory gap, and your own challenge on paper - and a start you can make this week: pull three systems rated low and ask why. Drawn from the final MAS Guidelines on AI Risk Management (October 2026), by the person who wrote them. About twenty pages, written plainly, and deliberately boring. This primer is the gateway to the full book, *AI Risk Management for Risk and Compliance* (listed here separately), which works each question in depth - the three lines, the inventory and the rating, the controls before and after go-live, third-party AI, and building your own function. If this primer was useful, pass it along.
For the second line's view and how this fits, see AI risk management for risk and compliance. https://quaintitative.com/ai-risk-management-for-risk-and-compliance/
Financial institutions are being sold generative AI that will transform their work, and agents that will do the work for them. Some of it is useful. Some of it is hype. This primer is the short version of how to tell the difference, in one sitting.
Three chapters carry the spine. How the machinery works: next-token prediction, what training does and doesn't fix, the context window, and retrieval. Where it helps: deciding per feature, the uses that actually work in finance, prompts and prompt injection, and why a chatbot is a system, not a model. Agents, and the checks: the loop and its harness, least privilege, how agents fail across steps, the trajectory, evals, and guardrails - including why a rule you can talk a model out of is not a control.
Written by the person who led AI risk supervision at the Monetary Authority of Singapore and wrote Singapore's AI risk management guidelines for the financial sector. About twenty pages, deliberately boring.
This primer is the gateway to the full book, Agentic & Generative AI for Finance (listed here separately), which works through the machinery and the checks in depth - the training, the retrieval, the prompts, the agent loop, the tests, the runtime controls, and the records. If this primer was useful, pass it along.
AI Fundamentals
Understand how AI actually works once, so the next new model or paper stops being a mystery.
You sit through the workshops and the demos. Someone shows a clever prompt, everyone marvels at the output, and no one stops to ask what the model is actually doing - what data it is seeing, what task it is solving, why it works here but might not on the next example. So when the next model drops, you feel like you have to relearn everything. I call this prompt and pray, and it wears you out.
The fix is boring, and it lasts. Before reaching for a model, ask three questions: what data do I have, what task am I doing, which method fits. My PhD supervisor put it in three words - "Let's start with the task" - and years of working through data types and tasks showed me he was right. That is what this book teaches: how to see AI through the lens of data types and tasks.
Why it matters now, in the age of LLMs and agents: prompts are brittle, and a framework for thinking is more durable than a harness. AI has always been about data and tasks. LLMs wrap over those tasks in a more general way; agents are an LLM orchestrating tools and other LLMs on tasks. Strip the headline away and the data types and tasks are the same ones that were there ten years ago.
What you get: the book works through the main data types - tabular, text, image, networks, and time series - the same way each time. What the data is, how you break it down, how AI works on it. From the current landscape to the frontier. Learn the pattern once and you can look at any new tool or paper and understand what it is doing, instead of relearning the hype every six months.
If you are here for the frontier, you are in the wrong place. This is deliberately about the boring fundamentals - the part of AI that does not expire when the next model drops.
For how this underpins AI risk management, see AI risk management, explained.
I call it "prompt and pray." A workshop, a demo, a clever prompt, everyone marvels - and no one stops to ask what the model is actually doing, what data it's seeing, what task it thinks it's solving. This primer is the opposite: the boring fundamentals that outlast every model launch. The frame is three questions. What data do I have? What task am I doing? Which method fits? Around them, four short moves. An AI model is just math - form, loss, train, evaluate, the same four questions under a line through points, a neural network, an LLM, and an agent. The shape of your data decides what follows - five data types, one grid, very different structures. The magic wand conceals a toolbox - every AI project is a chain of named tasks from a small set of families. And machine learning, deep learning, generative AI, and agentic AI are four setups over the same three parts. About 30+ pages, in plain English. Written by someone who started a PhD in AI at 42 after years of managing investment risk, and wrote Singapore's AI risk guidelines - for anyone who wants to understand what they're looking at before reaching for a model. This is the gateway to the full book, *Thinking in AI*, which takes the frame through each of the five data types in depth - why a small model on a spreadsheet still beats billion-parameter models at most real decisions, how a five-step language pipeline collapsed into one model, why your ECG and a stock chart are the same kind of problem. Free to download, and free to pass along.
For how this underpins AI risk management, see AI risk management, explained.
Someone asks me, or I ask myself, where to even start with learning AI. Search and you drown - a thousand courses on prompting a chatbot, and almost none on how any of it works. This is the answer I keep giving. The handful of resources that actually taught me AI, from the years I taught myself the basics and then did a PhD in it, roughly 2015 to 2023, before the ChatGPT hype. Grouped by what they are good for: the on-ramps like Andrew Ng and fast.ai, the books worth keeping on the desk, the explainers for when a concept will not click, and the deeper corners by the shape of your data. Each entry has a note on why it is worth your time, and an honest opinion on which to do first. Almost everything here predates LLMs and still holds, because the fundamentals move far slower than the headlines. A course from 2017 will still teach you more about how AI works than a viral post on ten things a chatbot can do. What you get: a curated path through a noisy field, from someone who learned it the slow way and now teaches it. The PDF to download and keep, free.
For where this leads in finance, see the complete guide to AI risk management in finance.
https://quaintitative.com/complete-guide-ai-risk-management-finance-singapore/
AI Governance & Risk Management
You're being asked to put AI into real decisions and to answer for it when something goes wrong. These show you how to govern AI so you can stand behind it, from first principles up to running it at scale, and for the board.
Plain-English guides to AI risk management and governance in financial services, from the person who wrote Singapore's MAS AI Risk Management Guidelines (AIRG).
You have twenty frameworks to comply with, two hundred use cases to govern, and a control checklist a thousand questions long for each. Multiply it out and you get millions of boxes. Tick them all and you still are not governed - you are just very busy. Governance that grows faster than the AI does not scale, and most of what passes for AI governance today is exactly that.
This short book compiles some thoughts on three moves that collapse twenty frameworks and hundreds of use cases into one backbone you can actually manage - and scale.
Govern to a common spine. Strip the packaging off twenty frameworks and they ask the same questions. Build one backbone and twenty columns collapse to one.
Govern with the unit that scales. "What are the use cases?" is the wrong first question - a use case is the least scalable thing to govern. Underneath sit units that repeat. Govern those once and every use case inherits.
Govern as a system, not a checklist. A thousand-question checklist passed box by box still fails, because the boxes do not talk to each other.
Some ideas on how to keep control of AI as the number of systems climbs - in a firm, a regulator, or a team of one - without a pricey consultant and without drowning in boxes. It is deliberately boring, because the parts that last usually are. I wrote Singapore's first AI risk management guidelines for the financial sector, and much of this is what I wish I could have said in the margins of them.
For the fuller picture, see governing AI at scale.
The business wants more AI use cases. You answer to more jurisdictions every year, each with its own AI framework. And every consultant who walks in hands you another thousand-row control checklist that maps to all of them and manages none of it. There is plenty written for the board, and a fair amount for the supervisor. There is far less for the person in the middle - the second line, who has to run the risk-management system day to day and challenge a first line that knows the models far better. This book is for that seat, built on six questions. Does one approach govern AI risk consistently across the whole firm? Is there a net that catches AI as it enters, and do the low ratings survive a second look? Does anything actually run off the inventory, or is it a list? Does the testing show the system is good enough for your task, or only that it scored well on someone else's benchmark? Do the controls reinforce each other, or is it a checklist? And has the firm decided, deliberately, where it can move fast? Then it goes deeper: the three lines from the inside, the inventory and the rating, challenging AI before go-live, watching it after, third-party AI, and building your own function - each chapter ending with a "what to own" summary and the questions to put to your first line, or to yourself. It reads from the final MAS Guidelines on AI Risk Management (October 2026), written by the person who drafted them and who led the earlier thematic review of how banks actually manage AI model risk. The interpretations are the author's own, and deliberately boring: no new discipline, no longer checklist - your existing model-risk, third-party and technology-risk muscle, pointed at the right places, run as a system. About eighty pages, with hand-drawn figures throughout. A shorter primer of the six questions is listed separately, if you want to start there.
For the second line's view and how this fits, see AI risk management for risk and compliance. https://quaintitative.com/ai-risk-management-for-risk-and-compliance/
You did not build the models. You cannot read the weights. The firm's data scientists know its systems far better than you ever will, and the firm shows you its best side because that is what firms rationally do. Your job is to inspect, from outside, on a few days a year, whether its AI risk management is real. This book is how. It starts with a few simple questions to put to any firm: does one approach govern AI risk consistently across the whole firm, is there a net catching AI as it enters and would the low ratings survive a second look, does anything actually run off the inventory, can the firm show what good enough means for its task, do the controls reinforce each other, and has the firm decided where fast is safe. Then the craft behind them: what you are actually assessing (the management of the model, not the model), where firms hide risk, proportionality across the sector and inside the firm, the inventory and the rating, assessing AI before go-live and watching it after, third-party AI and the concentration only a supervisor can see, and capability on both sides of the table. Along the way, the traps specific to your seat: the day your inspection becomes the approval, the records assembled for your visit, and the fact that firms build what supervisors inspect. It is written by the person who led AI risk supervision at the Monetary Authority of Singapore, wrote Singapore's AI risk management guidelines for the financial sector, and led the earlier thematic review of how banks actually manage AI model risk. The interpretations are the author's own, and nothing in the book depends on which instrument your regime anchors on: the main frameworks converge on the same few requirements. About eighty pages, with hand-drawn figures throughout, and deliberately boring. A shorter primer is listed separately, if you want to start there.
For the supervisor's view and how this fits, see AI risk management for regulators and supervisors. https://quaintitative.com/ai-risk-management-for-supervisors/
Agreeing that AI should be fair, reliable, and safe is easy. You still need evidence. This primer gives you the 8 questions to ask of any AI system, in one sitting: why did the model produce this result, does it treat groups differently, is the output good enough, how does it fail when someone tries to misuse it, what checks can prevent harm while it's running, what is it doing once people use it, what changes when it can take actions, and what evidence does someone need to approve it.
It closes with a start you can make this week: pick one system you're responsible for, work through the questions, and write down the gaps.
Written by the person who led quantitative model risk inspections and AI risk supervision at the Monetary Authority of Singapore, and wrote Singapore's AI risk management guidelines for the financial sector. About a dozen pages, deliberately boring.
This primer is the gateway to the full book, Boring Questions for AI Lifecycle Risk Management (listed here separately), which works each question in depth - what it means, what to look for, and the open-source tools to start your learning journey. If this primer was useful, pass it along.
A good prompt helps. It won't replace an understanding of how the system works or the checks needed before you let it act.
This book explains that machinery in four parts. How it actually works: the four approaches, how a language model produces text one token at a time, what training does and doesn't fix, the context window, and retrieval. Generative AI in finance: choosing the right tool per feature instead of per project, the uses that actually work, and the prompt and the chatbot built around it - including prompt injection and why the critical restrictions live outside the model. Agents: the loop and its harness, tools and least privilege, how agents fail across several steps even when each step looks fine, and the trajectory - what to record so you can reconstruct what the system did, in what order, and with whose authority. And making it safe to use: evals for answers and actions, guardrails, workable human review, and monitoring.
Along the way it names the terms you'll hear - prompt engineering, context engineering, the harness, evals, LLM-as-a-judge, human-in-the-loop - and shows what each one actually buys you. Finance examples throughout, from covenant summaries to payment agents. Thirty hand-drawn figures, the key lines bolded, no code.
It is written by the person who led AI risk supervision at the Monetary Authority of Singapore and wrote Singapore's AI risk management guidelines for the financial sector. You don't need to build a model to follow it. But you should come away able to ask a team what its system does, what could go wrong, and how it would know.
All of it is deliberately boring. That is the point. About eighty pages. A short primer is listed separately, if you want the tour first.
A director at a board I was briefing asked me a simple question: what do I actually need to know about AI? I did not answer it well at the time. And so this is the answer, written down. A short, board-facing book that reads the AI problem through the financial sector's risk discipline - the one built over decades and paid for in real losses. It is built on the MAS AI Risk Management Guidelines (AIRG), which I wrote, and it takes the generalist SID AI Guide for Boards in Singapore as its starting point. Comparison and extension, not a critique - it just follows the finance lens further than a general guide can. Five questions, one for each thing a board owns. Approve the approach. Set the appetite. Get the roles clear. Understand enough to challenge. Review the approach. Each one turns the obvious question into another one a financial-sector board should be asking - who really owns the risk, what "good enough" means for the task, when a control has quietly been skipped - and shows where the answer for finance is not the generalist answer. You do not need to send your directors on a prompt-engineering course. You need a handful of durable questions that do not expire when the next model ships. That is what this is - about thirty plus pages, five questions, and the detail behind each one, to take into the next board meeting. Written for directors, especially in financial institutions, but useful to any board that takes AI risk seriously.
For the board's view and how this fits, see AI risk management for boards. https://quaintitative.com/ai-risk-management-for-boards/
Someone will try to sell your organisation AI governance that looks impressive - an ethics framework, a principles workshop, a thousand-question checklist. Most of it won't actually manage anything. This primer is about another view: not AI governance principles, but the underlying first principles of AI risk management.
Part one is the AI. One idea - a line through points - scaled up from machine learning to deep learning, language models, RAG systems, and agents. Every step up buys more capability and more of the three U's: uncertainty, unexpectedness, unexplainability. No equations, no code - just the mental models, including why language models make things up, why testing once tells you little, and why the sensible architecture is often the boring one.
Part two is the risk management. The whole framework fits on a napkin: what do you have, how are you managing it, who's accountable. Then one level down - the system that answers those questions as a cycle, the lifecycle controls in 3 groups, and why the controls only work together, as a system, not a checklist.
Written through the financial sector's risk lens by the author of Singapore's AI risk management guidelines, but built to work for hospitals, hiring, and government services too. About 36 pages.
This primer is the gateway to the full book and guided course - AI Risk Management from First Principles - planned for 4Q 2026.
For the whole picture in one place, see the complete guide to AI risk management in finance in Singapore.
https://quaintitative.com/complete-guide-ai-risk-management-finance-singapore/
Most of what passes for AI governance is a pile of boxes that grows faster than the AI does - and never quite governs it. Multiply it out: twenty frameworks, two hundred use cases, a thousand questions per checklist. Four million boxes. Even if you ticked them all, you still wouldn't be governed. You'd just be really really busy.
This primer is the opposite argument, in three moves, written by the author of Singapore's first AI risk management guidelines for the financial sector. For anyone trying to keep control of AI as the number of systems climbs, in a firm, a regulator, or a team of one.
This primer is the gateway to the fuller book, Some Thoughts on Scaling AI Governance.
For the fuller picture, see governing AI at scale.
You sit across the table from firms whose models you did not build and cannot see inside. This primer is how to judge them anyway, in a few simple questions: one consistent approach, a net that catches AI as it enters, an inventory that things actually depend on, evidence tested to the firm's own task, controls that work as a system, and a deliberate decision about where fast is safe. It closes with the three places firms hide risk from you - the low rating, the inventory gap, and oversight on paper - and a start you can make on your next visit: ask for the full inventory, pick three systems rated low yourself, and ask why. Written by the person who led AI risk supervision at the Monetary Authority of Singapore and developed Singapore's AI risk management guidelines for the financial sector. Nothing in it depends on which instrument your regime anchors on. About twenty pages, written simply, and deliberately boring. This primer is the gateway to the full book, *AI Risk Management for Regulators and Supervisors* (listed here separately), which works each question in depth - what you are actually assessing, where firms hide risk, proportionality, the inventory and the rating, the controls before and after go-live, third-party AI, and capability on both sides of the table. If this primer was useful, pass it along.
For the supervisor's view and how this fits, see AI risk management for regulators and supervisors. https://quaintitative.com/ai-risk-management-for-supervisors/
Financial institutions are being sold generative AI that will transform their work, and agents that will do the work for them. Some of it is useful. Some of it is hype. This primer is the short version of how to tell the difference, in one sitting.
Three chapters carry the spine. How the machinery works: next-token prediction, what training does and doesn't fix, the context window, and retrieval. Where it helps: deciding per feature, the uses that actually work in finance, prompts and prompt injection, and why a chatbot is a system, not a model. Agents, and the checks: the loop and its harness, least privilege, how agents fail across steps, the trajectory, evals, and guardrails - including why a rule you can talk a model out of is not a control.
Written by the person who led AI risk supervision at the Monetary Authority of Singapore and wrote Singapore's AI risk management guidelines for the financial sector. About twenty pages, deliberately boring.
This primer is the gateway to the full book, Agentic & Generative AI for Finance (listed here separately), which works through the machinery and the checks in depth - the training, the retrieval, the prompts, the agent loop, the tests, the runtime controls, and the records. If this primer was useful, pass it along.
You want to get on top of AI risk and governance, but where do you even start? Search Google or Perplexity and you get more results than anyone can reasonably read - most of it noise, much of it vendor pitches. It is easy to spend hours and come away with nothing.
This book is the answer I keep giving when people ask. Six short reading lists of papers, guidelines, and articles - governance, data management, evaluation and testing, human oversight, third-party AI risk, and explainability - each entry with a note on why it is useful and worth your time. Organized in circles of progression: start at the center and work outwards. Read the one you need; nothing here assumes you read the others.
What you get: a clear, curated path through a noisy field, so you can start on the right things instead of drowning in search results. No affiliate links, no vendor pitches - just what is worth reading in each area, from someone who wrote a national set of AI risk guidelines and has read most of the rest. Work through it and you will understand AI risk better than most people paid to talk about it.
Not exhaustive, but a good place to start.
For the finance-focused version kept most current, see the AI risk management resource list.
https://quaintitative.com/ai-risk-management-finance-resources/
AI governance gets difficult when someone asks how you'll check whether a system works as it should. The principles are easy to agree with. You still need evidence. This book is built on 8 questions, asked in the order a system meets them across its lifecycle. Why did the model produce this result? Does the system treat groups differently? Is the output good enough for the task? How does it fail when someone tries to misuse it? What checks can prevent harm while it's running? What is it doing once people use it? What changes when it can take actions? And what evidence does someone need to approve it? One chapter per question: what it means, what to look for, and what good looks like - with hand-drawn figures throughout, the key lines bolded, and a short "where to start" at each chapter's close naming the open-source tools (20+ across the book, from LIME and Fairlearn to garak, tau-bench, and AI Verify). No code. You can read it in one sitting and walk into the next review or vendor meeting knowing what to ask. It is written by the person who led quantitative model risk inspections and AI risk supervision at the Monetary Authority of Singapore, and wrote Singapore's AI risk management guidelines for the financial sector. The questions are the ones he uses. And a new tool won't settle what fair means in your setting, or how many errors you're prepared to accept - someone still has to make those decisions and explain them. This book is how you get there. All of it is deliberately boring. That is the point. About forty pages. A short primer is listed separately, if you want the questions first.
An agent is not a chatbot with a new name. It acts - it looks up accounts, issues refunds, sends emails - and each choice opens more choices, until nobody can review every path. A simple billing-dispute agent has thousands. This primer is one picture to think with: the agent as a tree of paths, governed the way a bonsai is tended. Cut, and wire. Cut the branches that must never happen - the permission that was never granted cannot be argued with, tricked, or talked past. Then hold the rest with 3 kinds of wire. Rigid wire: rules coded into the tools, not prayers written into the prompt. Supple wire: a model posted as judge - useful, and a second tree you now have to govern. And your own hands: evaluation and testing that reads the path instead of the answer, repeats every run, and probes through everything the agent reads. Along the way: why 95% reliability per step becomes 60% over ten steps, why a rule in the prompt is a request while a rule in the tool is a control, why fluent wrongness passes a fluency check, and the sign-off questions that cannot be answered with adjectives - show me the trajectories; what happens if the model ignores this control; what is the success rate across 8 repeated runs? About 40 pages, with figures for nearly every idea. Written by the author of Singapore's AI risk management guidelines and deliberately general: the ideas apply to agents anywhere, not just in finance. This primer is the gateway to the fuller book - *AI Risk Management: Agentic AI*, the supervisory expectations, registers, evaluation practice and worked examples behind this way of thinking - planned for 4Q 2026.
For the fuller picture, see agentic AI risk management. https://quaintitative.com/agentic-ai-risk-management/
Build AI tools for finance you can actually trust, grounded in real data and real calculations, not confident guesses. With code you can run.
AI in Finance
Open ChatGPT, Claude, or Gemini and ask it to build you a low-volatility portfolio. You will get a confident, reasonable-sounding answer. But did it actually check the volatility? Calculate whether the allocation can hit your target? Verify the correlations? Maybe. And maybe it hallucinated the whole thing and told you with complete confidence. You cannot tell which - and if this powers your real portfolio, that is a serious problem.
This is not a bug in any one model. It is how LLMs work: they are good at language, not at being databases or calculators. Real finance questions are multi-step - fetch the data, calculate the metrics, check the correlations, optimize the allocation - and an LLM on its own cannot do them reliably. Unless you give it tools. That is what this book is about.
What you get: four patterns - tool calling, ReAct, CodeAct, and orchestration - that ground an LLM in real data and real calculations, each explained plainly and with working code you run yourself in Google Colab. A finance primer if you want the concepts underneath the metrics. An n8n bonus chapter that builds the same patterns as visual workflows, with no Python. By the end you will have built a working portfolio assistant that fetches real prices, calculates real metrics like volatility, Sharpe ratio, and value at risk, shows its reasoning at each step, and answers follow-ups about your holdings.
It gets you from "LLMs hallucinate" to "I have a working tool I can trust." It covers analysis, not execution, and stops short of production deployment - that is a bigger next step. Helpful but not required: basic Python, some APIs, some finance. Not required: ML expertise or any prior agent experience. If you can read, you have enough to start. The reason it works is not that the model is smarter, but that the architecture is right.
You get the PDF to download and keep, along with the code.
For the risk-aware view, see the risks of AI investing.
Someone will try to sell you an LLM that predicts the future. It will sound confident, and it will be wrong more often than it lets on. Forecasting is usually the AI task most oversold and least understood. This free primer provides some mental models to understand why. Why a language model cannot forecast on its own - text and time are different kinds of sequence. What actually forecasts: the ladder from fifty-year-old classical models that still win competitions, through machine learning and deep learning, to the foundation models trying to become the ChatGPT of time. And why one rational way to use AI here is with an agent - a reasoning loop that drives real forecasting tools and checks the results against reality. No code, no notebooks, no math you need a whiteboard for. You also leave with a working detector for nonsense: the questions that separate a real forecasting system from a confident paragraph - was it backtested, was the test split by time, did it beat the naive baseline. Written by someone who did a PhD building forecasting models and wrote Singapore's first AI risk management guidelines for the financial sector. The upcoming companion, *AI Agents for Advanced Forecasting*, builds everything here in code - the tools, the agent patterns, runnable notebooks - and is targeted for 4Q 2026. This primer is the why. Free to download and keep.
For the risk-aware view, see the risks of AI forecasting.
The business wants more AI use cases. You answer to more jurisdictions every year, each with its own AI framework. And every consultant who walks in hands you another thousand-row control checklist that maps to all of them and manages none of it. There is plenty written for the board, and a fair amount for the supervisor. There is far less for the person in the middle - the second line, who has to run the risk-management system day to day and challenge a first line that knows the models far better. This book is for that seat, built on six questions. Does one approach govern AI risk consistently across the whole firm? Is there a net that catches AI as it enters, and do the low ratings survive a second look? Does anything actually run off the inventory, or is it a list? Does the testing show the system is good enough for your task, or only that it scored well on someone else's benchmark? Do the controls reinforce each other, or is it a checklist? And has the firm decided, deliberately, where it can move fast? Then it goes deeper: the three lines from the inside, the inventory and the rating, challenging AI before go-live, watching it after, third-party AI, and building your own function - each chapter ending with a "what to own" summary and the questions to put to your first line, or to yourself. It reads from the final MAS Guidelines on AI Risk Management (October 2026), written by the person who drafted them and who led the earlier thematic review of how banks actually manage AI model risk. The interpretations are the author's own, and deliberately boring: no new discipline, no longer checklist - your existing model-risk, third-party and technology-risk muscle, pointed at the right places, run as a system. About eighty pages, with hand-drawn figures throughout. A shorter primer of the six questions is listed separately, if you want to start there.
For the second line's view and how this fits, see AI risk management for risk and compliance. https://quaintitative.com/ai-risk-management-for-risk-and-compliance/
Someone will try to sell you an LLM that manages your money. It will sound confident. Some of it will be made up, and it will not tell you which parts. This primer is about why that happens - an LLM on its own has no data and no calculator - and about the fix, which is not a smarter model. It is the right architecture. Five ideas, in about twenty-five pages. LLMs are buns, not meat: good at the language, not at the numbers. Most tasks don't need an agent - the complexity ladder tells you when a workflow will do. An agent is four parts - model, tools, instructions, memory - holding three kinds of tools, and only one kind should ever act without a human. Four patterns cover the work: tool calling, ReAct, CodeAct, orchestration. And the demo is not the product - the gap to production is guardrails, approval, and audit, not cleverer models. No code, no notebooks. Written for anyone who will buy, build, or approve an AI tool that touches a portfolio - and who wants to be able to tell, when shown one, whether it is calling real tools or generating a confident paragraph. This is the primer to the full book, *AI Agents for Investing* (listed in this catalogue), which builds all of it in runnable code: the tools, the four patterns, a working portfolio assistant, and a no-code path for people who would rather not write Python.
For the risk-aware view, see the risks of AI investing.
You sit across the table from firms whose models you did not build and cannot see inside. This primer is how to judge them anyway, in a few simple questions: one consistent approach, a net that catches AI as it enters, an inventory that things actually depend on, evidence tested to the firm's own task, controls that work as a system, and a deliberate decision about where fast is safe. It closes with the three places firms hide risk from you - the low rating, the inventory gap, and oversight on paper - and a start you can make on your next visit: ask for the full inventory, pick three systems rated low yourself, and ask why. Written by the person who led AI risk supervision at the Monetary Authority of Singapore and developed Singapore's AI risk management guidelines for the financial sector. Nothing in it depends on which instrument your regime anchors on. About twenty pages, written simply, and deliberately boring. This primer is the gateway to the full book, *AI Risk Management for Regulators and Supervisors* (listed here separately), which works each question in depth - what you are actually assessing, where firms hide risk, proportionality, the inventory and the rating, the controls before and after go-live, third-party AI, and capability on both sides of the table. If this primer was useful, pass it along.
For the supervisor's view and how this fits, see AI risk management for regulators and supervisors. https://quaintitative.com/ai-risk-management-for-supervisors/
An agent is not a chatbot with a new name. It acts - it looks up accounts, issues refunds, sends emails - and each choice opens more choices, until nobody can review every path. A simple billing-dispute agent has thousands. This primer is one picture to think with: the agent as a tree of paths, governed the way a bonsai is tended. Cut, and wire. Cut the branches that must never happen - the permission that was never granted cannot be argued with, tricked, or talked past. Then hold the rest with 3 kinds of wire. Rigid wire: rules coded into the tools, not prayers written into the prompt. Supple wire: a model posted as judge - useful, and a second tree you now have to govern. And your own hands: evaluation and testing that reads the path instead of the answer, repeats every run, and probes through everything the agent reads. Along the way: why 95% reliability per step becomes 60% over ten steps, why a rule in the prompt is a request while a rule in the tool is a control, why fluent wrongness passes a fluency check, and the sign-off questions that cannot be answered with adjectives - show me the trajectories; what happens if the model ignores this control; what is the success rate across 8 repeated runs? About 40 pages, with figures for nearly every idea. Written by the author of Singapore's AI risk management guidelines and deliberately general: the ideas apply to agents anywhere, not just in finance. This primer is the gateway to the fuller book - *AI Risk Management: Agentic AI*, the supervisory expectations, registers, evaluation practice and worked examples behind this way of thinking - planned for 4Q 2026.
For the fuller picture, see agentic AI risk management. https://quaintitative.com/agentic-ai-risk-management/
A good prompt helps. It won't replace an understanding of how the system works or the checks needed before you let it act.
This book explains that machinery in four parts. How it actually works: the four approaches, how a language model produces text one token at a time, what training does and doesn't fix, the context window, and retrieval. Generative AI in finance: choosing the right tool per feature instead of per project, the uses that actually work, and the prompt and the chatbot built around it - including prompt injection and why the critical restrictions live outside the model. Agents: the loop and its harness, tools and least privilege, how agents fail across several steps even when each step looks fine, and the trajectory - what to record so you can reconstruct what the system did, in what order, and with whose authority. And making it safe to use: evals for answers and actions, guardrails, workable human review, and monitoring.
Along the way it names the terms you'll hear - prompt engineering, context engineering, the harness, evals, LLM-as-a-judge, human-in-the-loop - and shows what each one actually buys you. Finance examples throughout, from covenant summaries to payment agents. Thirty hand-drawn figures, the key lines bolded, no code.
It is written by the person who led AI risk supervision at the Monetary Authority of Singapore and wrote Singapore's AI risk management guidelines for the financial sector. You don't need to build a model to follow it. But you should come away able to ask a team what its system does, what could go wrong, and how it would know.
All of it is deliberately boring. That is the point. About eighty pages. A short primer is listed separately, if you want the tour first.
