Risk classification
Where each system sits under the EU AI Act — prohibited, high-risk, limited, minimal — determines everything downstream. Misclassify and you either overbuild or ship an unguarded high-risk system.
03 · AdvanceGoverned intelligence
Deploy the frontier.In a defensible form.
Risk classification, explainability, drift and bias monitoring, and the technical file an assessor reads — engineered into the system rather than assembled under deadline once somebody senior asks.
The position
Anyone can deploy a model. Far fewer can defend one.
The constraint on serious AI adoption is no longer capability. It is whether the organization can evidence how a system decides, who may overrule it, and what was true of it on a given day last year.
Where the discipline comes from
We build and operate infrastructure where every state change is logged and attributable, and where a regulator can ask for the record without warning. AI governance is that same problem with a different subject: prove what the system did, why, and who could have stopped it.
EU AI ActConformity assessmentModel audit trailsHuman authority
What gets asked
Four questions that decide whether it survives review.
Governance work fails in the same places every time — not because the model is poor, but because nobody can produce the evidence that it is sound.
01
Which of your AI systems is high-risk?
Most organizations cannot answer, because nobody has enumerated them. Classification begins with an inventory — including models embedded in tools that were bought rather than built, which carry obligations of their own.
02
Who is accountable when it is wrong?
Human oversight means a named role with the authority and the interface to override an output, and a record showing the override occurred. If the only route is a support ticket, oversight is nominal.
03
Can you reconstruct a decision from six months ago?
Model version, prompt, retrieved context, parameters and output must be recoverable together. A log of outputs alone proves nothing about how they were reached.
04
What happens when it drifts?
There should be a threshold, an alert, an owner and a documented response. An intention to retrain is not a control.
What we build
The evidence layer, engineered in.
Not a policy document. The instrumentation, gates and records that make the policy true — and that hold when someone checks.
Explainability
Attribution wired into the serving path rather than produced once in a notebook. When a decision is challenged, you can show which inputs moved it and by how much.
Drift monitoring
Models degrade quietly. Input and output distributions are held against the baseline the system was assessed on, with alerting before the drift reaches outcomes.
Bias and fairness testing
Disparity testing across the groups that matter for the use case, enforced as a pipeline gate rather than a report written after deployment.
Conformity documentation
The technical file an assessor actually opens: intended purpose, data governance, accuracy and robustness metrics, human-oversight design, and how each was verified.
Model audit trails
Every prompt, retrieval, tool call and human override recorded and attributable — the same audit discipline applied to financial infrastructure, pointed at model behavior.
The rest of the mandate
Three disciplines. One operating layer.
Have your AI systems been classified yet?
If not, that is the engagement. We inventory what is running, classify it, and state plainly where the gaps are — before anyone external does it for you.