Policy & Regulation · entry 04/05

Compliance in practice

Model cards, impact assessments, audit trails, incident channels — the artifacts AI governance actually produces, and how to build them without strangling the roadmap.

The artifact list

Strip the legal prose and most AI obligations reduce to producible artifacts. System documentation: what the model does, what it was trained on, known limitations — model cards and system cards graduating from research etiquette to regulatory expectation. Risk and impact assessments: structured "what could go wrong, for whom, and what did you do about it," echoing privacy's DPIA playbook. Evaluation evidence: test results for the claims you make — accuracy, bias, robustness — on data you can defend. Human oversight design: who can intervene, how fast, with what information. Logs: enough traceability to reconstruct what the system did and why, which is versioning discipline wearing a badge. Teams that already practice serious MLOps discover they own 70% of compliance; the rest is writing it down.

Data governance is where it bites

The hardest questions are upstream. What's in the training data, under what rights? Copyright litigation is redrawing this map in real time — courts have started distinguishing training on lawfully acquired material from training on pirated copies, with settlements large enough to be board-level news — and "we can't say what we trained on" is aging from awkward to disqualifying. Privacy law applies too: personal data in training sets, deletion requests against models, cross-border transfer. Provenance tracking for data — source, license, consent status — is becoming a first-class pipeline feature, not a spreadsheet someone maintains until they quit.

Making it operational

Governance that works looks like engineering, not committees: requirements mapped to controls, controls to owners, evidence generated by the pipeline automatically (eval reports, data lineage, deployment approvals) rather than assembled heroically before audits. A cross-functional review gate for high-risk launches — legal, security, ML — with authority to block, staffed by people who can read an eval report. Vendor management matters doubly: your provider's model is inside your compliance boundary, so their documentation, retention terms, and safety testing become your due-diligence file.

Failure mode

Compliance as a document instead of a property. The assessment gets written, filed, and never consulted; the system drifts; the paperwork describes a product that no longer exists. Regulators are learning to ask for the living version — logs, current evals, incident records — and the gap between the binder and the system is exactly what enforcement actions cite. Wire the artifacts to the pipeline so they regenerate with every release, and the audit becomes a query instead of an excavation.