AI governance
AI assurance is cheaper before go-live than after
Assurance proves, with evidence rather than intentions, that a system does what it should and keeps doing it after handover. Retrofitting it onto something already in production costs materially more.
AI is going into production faster than most organisations can build governance for it. That gap between deployment speed and governance maturity is where the risk actually sits, and it is not a documentation problem. It is an engineering one.
The distinction that matters is between a sign-off and a standing control. Conventional software is tested once against a specification, and if the code does not change it behaves the same way in month thirteen as it did on day one. A model offers no such guarantee. It behaves probabilistically, and it drifts in production while the code sits untouched.
What assurance has to cover
Four things, none of which can be added convincingly once the system is already carrying load:
- What the system is allowed to decide on its own, and where the boundary sits that sends a case to a person.
- What is logged, at what granularity, and whether the log is sufficient to reconstruct a decision months later.
- Who reviews its decisions, on what schedule, against what threshold for intervening.
- How it is withdrawn — the rollback path, who authorises it, and what runs in the interim.
Why the order is not negotiable
Retrofitting assurance means reconstructing decisions that were never logged with reconstruction in mind. The evidence needed to prove the system behaved correctly in month three usually does not exist in month nine, because nobody specified that it should be kept.
This is the L4 Accountability layer of the framework we publish, and it belongs in the preliminary engineering design rather than bolted on at commissioning. Our practice is aligned to ISO/IEC 42001:2023, with the Singapore IMDA framework and the NIST AI Risk Management Framework as reference points. That standard concerns the management system around the AI — governance, roles, continual improvement — not a guarantee about any particular model's output, and a proposal that conflates the two is overstating what it has.