Knowledge Base / Generative AI
Generative AI
Generative AI tools are easy to start with and surprisingly hard to run well. Answers can be fluent and wrong, private data can leak into prompts, downloaded models can carry hidden risks, and an unprotected endpoint can turn into a large bill overnight.
The guides here explain how retrieval-augmented generation works, why models hallucinate and what actually reduces it, how to choose between prompting, retrieval and fine-tuning, how to write a workable privacy policy for AI use, how to treat models and datasets as part of your supply chain, how the NIST AI RMF and EU AI Act apply, and how to keep LLM API costs under control.
Suggested reading order
- 1Retrieval-Augmented Generation (RAG) Explained: Chunking, Embeddings and Reranking
How RAG systems work end to end, the design choices that decide answer quality (chunking, embeddings, hybrid search, reranking), how to evaluate retrieval, and the security controls to build in.
- 2LLM Hallucinations: Why They Happen and How to Reduce Them
What hallucinations are, why language models produce confident falsehoods, the practical mitigations (grounding, verification, constrained output), and the security angle of invented software packages.
- 3Fine-Tuning vs RAG vs Prompting: How to Choose
A decision guide for adapting a language model to your needs: what each approach changes, costs, data and privacy implications, and a simple order of operations.
- 4Data Privacy When Using Generative AI at Work: A Practical Policy Guide
What happens to data you send to AI tools, the main privacy risks (leakage, retention, training use, shadow AI), and how to write an acceptable-use policy employees will follow.
- 5AI Supply Chain Security: Models, Datasets and Safe Serialization
Why downloading a model is like running untrusted code, the risks in pickle-based model files, how to verify provenance, and how to build an AI bill of materials.
- 6Cost and Abuse Controls for LLM APIs: Rate Limits, Budgets and Denial-of-Wallet
How to protect an LLM-backed application from runaway spending and abuse using layered limits, authentication, quotas, caching, input caps and monitoring, with a serverless example.
- 7Governing Generative AI: NIST AI RMF and the EU AI Act in Plain Language
What the NIST AI Risk Management Framework and the EU AI Act ask of organizations, how they differ, the current timeline (including the 2026 delays), and a lightweight governance program for a small company.
All Generative AI articles (7)
- 3 min readAI Supply Chain Security: Models, Datasets and Safe SerializationWhy downloading a model is like running untrusted code, the risks in pickle-based model files, how to verify provenance, and how to build an AI bill of materials.
- 4 min readCost and Abuse Controls for LLM APIs: Rate Limits, Budgets and Denial-of-WalletHow to protect an LLM-backed application from runaway spending and abuse using layered limits, authentication, quotas, caching, input caps and monitoring, with a serverless example.
- 4 min readData Privacy When Using Generative AI at Work: A Practical Policy GuideWhat happens to data you send to AI tools, the main privacy risks (leakage, retention, training use, shadow AI), and how to write an acceptable-use policy employees will follow.
- 3 min readFine-Tuning vs RAG vs Prompting: How to ChooseA decision guide for adapting a language model to your needs: what each approach changes, costs, data and privacy implications, and a simple order of operations.
- 4 min readGoverning Generative AI: NIST AI RMF and the EU AI Act in Plain LanguageWhat the NIST AI Risk Management Framework and the EU AI Act ask of organizations, how they differ, the current timeline (including the 2026 delays), and a lightweight governance program for a small company.
- 4 min readLLM Hallucinations: Why They Happen and How to Reduce ThemWhat hallucinations are, why language models produce confident falsehoods, the practical mitigations (grounding, verification, constrained output), and the security angle of invented software packages.
- 4 min readRetrieval-Augmented Generation (RAG) Explained: Chunking, Embeddings and RerankingHow RAG systems work end to end, the design choices that decide answer quality (chunking, embeddings, hybrid search, reranking), how to evaluate retrieval, and the security controls to build in.