Somebody has asked you to show your work on AI.

A customer, an investor or a regulator wants evidence that you know what your AI systems do. I set up something small enough that it survives contact with a real release cadence.

Tell me about it How it works

Signals you need this
Signal	Severity	Usually means
Nobody can list the models in production	High	No inventory
Unclear whether the EU AI Act applies	High	Unassessed exposure
Inventory is a spreadsheet from last year	Moderate	Drifted from reality
Review process everyone routes around	Moderate	Sized wrong
Cannot show who approved what	Unknown	No audit trail

Governance fails when it is designed to produce evidence rather than reduce risk

Most engineers' experience of governance is a process designed for an auditor, not for the team doing the work. It asks for documents nobody reads, at a cadence nobody can sustain, and so people route around it. A review process that cannot be completed inside a sprint does not make a system safer — it makes the record inaccurate.

The version worth having is boring and small. You know what models you run. You know which ones can hurt someone. Those get looked at by a human before they ship. You can show your work afterwards. Almost everything else is decoration.

The trick is making the inventory a by-product of shipping rather than a document someone maintains by hand. Documents maintained by hand go stale the week that person changes teams.

What I actually do

Build a model inventory that updates because it is wired into deployment, not because someone remembers
Classify systems by risk against the EU AI Act, NIST AI RMF or ISO 42001, and say plainly which ones are out of scope
Size the review process to how often you actually release, so it is completable rather than aspirational
Run a gap analysis with findings ordered by risk and by what each one costs to close
Set up the audit trail so you can answer "who approved this" without a search through chat history

What you end up with

An inventory that is still accurate in six months
A defensible risk classification for each system, with the reasoning written down
A review process your engineers will follow because it fits the way they work
A remediation roadmap your team can execute without me

How the work runs

Set it up, hand it over, typically three to six weeks
Stage	What happens
Week 1	What you actually run, and which frameworks genuinely apply to you.
Weeks 2 to 3	Inventory wired to deployment, risk classification, review process designed around your cadence.
Weeks 4 to 6	Gap analysis, remediation roadmap, and handing the whole thing to whoever owns it next.
After	A check-in a quarter later to see whether it held. Usually the interesting part.

Questions people ask

Does the EU AI Act apply to us?

That is the first question I answer, and sometimes the answer is no. Scope depends on what the system does, who it affects and where they are — not on where you are incorporated. Guessing wrong in either direction is expensive.

We are pre-revenue. Is this premature?

Usually yes, and I will say so. The exception is if you are selling to enterprises or operating in a regulated sector, where the first serious customer will ask. Then a small inventory now is much cheaper than reconstructing one later.

Will this slow our releases down?

It should not. If a governance process adds meaningful time to a release, it is sized wrong. The measure I care about is whether your engineers still follow it three months after I leave.

Can you do the paperwork for certification?

I am not an auditor and cannot certify anything. I do the engineering work that makes certification achievable, and I will tell you honestly if what you need is an auditor rather than me.