Your AI compliance audit will fail. Here is why.
Most organisations cannot prove they are doing anything right with AI. They lack the infrastructure for data lineage, decision logging, and explainability.
Pattern·AI compliance audit will failThe EU AI Act is in force. Regulatory frameworks in the UK, US, and Singapore are tightening. Your compliance team has started asking questions about your AI systems.
Most organisations will fail their first AI compliance audit. Not because they are doing anything wrong. Because they cannot prove they are doing anything right.
Compliance frameworks ask three questions about AI systems: What data did the model see? What decisions did it make? Can you explain why?
Answering these questions requires infrastructure that most teams have not built.
Data lineage. To answer "what data did the model see," you need to trace every model input back to its source. Not just the training data. Every inference input. This requires a data lineage system that tracks data through extraction, transformation, and feature engineering. Most data pipelines do not have this.
Decision logging. To answer "what decisions did it make," you need to log every model output with enough context to reconstruct the decision later. The input, the output, the model version, the confidence score, and any post-processing applied. At scale, this is a significant storage and compute cost that most teams have not budgeted for.
Explainability. To answer "can you explain why," you need interpretable model outputs or post-hoc explanation infrastructure. SHAP values, attention weights, feature importance scores. These are expensive to compute and most serving infrastructure does not support them in real-time.
- Start logging model inputs and outputs now, even before the audit
- Build data lineage into your pipeline infrastructure, not as a bolt-on
- Version everything: models, data schemas, feature definitions, business rules
- Create a model registry that links model versions to training data versions to evaluation results
- Assign ownership for AI compliance to a team that understands both the infrastructure and the regulatory requirements
The organisations that start building this infrastructure now will pass their audits. The ones that wait until the auditor asks will spend six months scrambling to reconstruct what they should have been logging from the start.
Get the next one in your inbox
One short, opinionated field note per fortnight on platform engineering, cloud, and making AI work in production. No spam. Unsubscribe anytime.
