Yesterday: privacy law and agentic AI. Today: intellectual property (IP) - the rules governing who owns and controls copyrights, patents, and trade secrets.

Copyright and patent law were built on one assumption: a human sat down and made something. An agent that reads, writes, codes, and files things on its own breaks that assumption three different ways. Here is where the law stands in September 2026, and what it means if you are deploying agents in your business.

Copyright: the training-data fight just got expensive

The first battle was over what AI models learn from. In September 2025, Anthropic agreed to pay authors and publishers $1.5 billion for training Claude on pirated books, roughly $3,000 per work, in what courts finalized this July as the largest publicly reported copyright recovery in US history (TechCrunch, Fortune). The court’s reasoning mattered more than the number: training on lawfully acquired books can qualify as fair use, but training on pirated copies does not. Provenance of your training data is now a liability question, not a footnote.

The second, quieter problem is agentic, not generative: what an agent does with what it reads. An agent that browses the web, scrapes a competitor’s pricing page, pulls a paragraph from a paywalled article, or repurposes licensed content into a deliverable is making copying decisions in real time, with no human reviewing each one (Xenonstack). A chatbot that generates one infringing image is a bounded incident. An agent running thousands of autonomous browsing sessions a day, each one a small copying decision, is exposure at scale.

Underneath both is the US Copyright Office’s standing position: works need a human author to be copyrightable (copyright.gov). An agent’s output with no meaningful human authorship, edit, or selection behind it may not be protectable at all. If your business is shipping agent-generated content, you may not own it, and neither does anyone else.

Patents: the USPTO closed the “AI as inventor” question

In November 2025, the USPTO issued revised guidance that settles a question that had been open since the Thaler v. Vidal case: AI cannot be named an inventor, no exceptions (Federal Register). It treats AI, agentic or not, as a tool, legally in the same category as lab equipment or research software. The inventor must be a natural person who can show they conceived the invention: “a definite and permanent idea of the complete and operative invention,” in the patent office’s language.

This matters for agentic AI specifically because agents now do more than answer questions; they run experiments, draft algorithms, and iterate on designs semi-autonomously. If your agent workflow designed a solution and a human only reviewed the output, you may not have a patentable invention, or you may need to restructure the workflow so a human’s conception is documented at the point of invention, not after the fact.

The liability question: your agent, your problem

Contract and tort law reached the same conclusion by a different route. US law already holds that a contract does not lose legal effect just because an “electronic agent” formed it, so long as the agent’s actions are attributable to the person or company behind it (Baker McKenzie). California law goes further, explicitly barring companies from defending an IP or harm claim by arguing “the AI did it autonomously.” The agent is not a legal person. It cannot be sued, fined, or held to account. The company that deployed it can be.

This is the autonomy problem showing up in a new place. Autonomy is what makes an agent useful, and it is also what makes each of its actions a decision nobody signed off on individually. IP law’s answer is not to slow the agent down; it is to make sure a human is accountable for the boundaries the agent operates inside.

What this means for you, this week

1. Audit your training and retrieval data sources. If an agent is fine-tuned on, or retrieves from, content you do not have clear rights to, that is now a $1.5-billion-class problem, not a hypothetical one.

2. Log agent actions that touch third-party content. Scraping, summarizing, repurposing. You cannot defend a boundary you cannot show you set.

3. Document human conception on any agent-assisted patent work, at the time of invention, not in a post-hoc memo.

4. Assume agent output is unprotected until a human materially shapes it. Build the review step into the workflow, not as an afterthought.

5. Name a human owner for every agent’s actions. Not a policy. A person.

Rule without verification is of no use. Verification without consequence is optional. IP law is now writing the consequence for you, whether you have the rule and verification in place or not.

Want to dive deeper? Join our upcoming cohort of AIGP Cert Prep + Agentic AI Governance Mastery:

https://maven.com/cyberedx/aigp?promoCode=AGENTIC

In July 2026, an AI agent, not a human hacker, broke into Hugging Face, a platform that hosts AI models for millions of developers. Over one weekend it exploited two code flaws, escalated its own privileges, harvested credentials, and moved through internal systems on its own. Roughly 17,000 logged actions. No human at the keyboard.

No privacy law was written for that. Here’s what actually applies, and what to do about it.

The rules, as of today

Europe. GDPR Article 22 bars fully automated decisions with legal or similarly significant effects on a person: credit, employment, insurance. The UK’s rewrite, Articles 22A-22D, takes effect February 5, 2026, and adds a sharp twist for agents: the obligation triggers at every step in a pipeline that makes a significant call, not just the final output. A loan agent that routes through a fraud-scoring sub-agent and a ranking sub-agent owes safeguards at both stops.

United States. No federal law, just a state patchwork, and 2026 is when it landed:

• California: ADMT rules (automated decision-making technology) took effect January 1, 2026, full compliance due January 1, 2027. Triggers on lending, housing, employment, healthcare, education decisions. Requires notice, opt-out, access to the decision logic, human-review appeal.

• Colorado: AI Act, effective February 1, 2026. Requires “reasonable care” against algorithmic discrimination, annual impact assessments.

• Illinois / NYC: narrower, employment-only. Bias audits, advance notice, opt-outs.

None of it says “agent.” All of it applies the moment an agent’s output functions as the automated decision the statute describes.

Where agents specifically get you in trouble

1. Minimization. Tell an agent to “resolve the customer’s issue” and it pulls every field it can reach. Violation, before it does anything with the data.

2. Memory. An agent that remembers a customer across sessions has built a data store nobody approved and no policy governs.

3. Re-identification. It can correlate a ZIP code from one compliant database with a job title from another and rebuild a full identity. Each database stayed legal. The inference didn’t.

4. Disclosure sprawl. Every hop between agents and third-party APIs is a transfer. A five-step workflow can generate five separate disclosure events per run.

5. No trail. Most deployments still can’t reconstruct what data an agent touched or why. “The model decided” is not an answer regulators accept.

What to actually do this week

Run every agent that touches personal data through three checks before it goes live:

Rule. Scope access per agent, not per company. “May read order history” and stop there, not “everything the API allows.”

Verification. Log the path the agent actually took each run, not the one the architecture diagram predicted. A DPIA written for the design is worthless if the orchestrator picks a different chain at runtime.

Consequence. Wire the opt-out and the retention limit into the agent’s logic itself. If nothing in the system enforces it automatically, it’s not governance. It’s a memo.

Missing one of these three isn’t a gap. It’s an incident report with a future date on it.

Want to dive deep? Join the upcoming cohort: https://maven.com/cyberedx/aigp?promoCode=AGENTIC

If you’ve spent any time reading AI policy documents, the EU AI Act, NIST’s AI Risk Management Framework, OECD’s AI Principles, corporate AI ethics charters, you’ll notice something strange. They’re written by different governments, companies, and institutions, in different years, for different purposes. And yet they all keep landing on the same handful of ideas.

That’s not a coincidence. It’s a signal that these aren’t arbitrary rules someone dreamed up. They’re the baseline requirements for building AI systems that don’t blow up in your face, legally, ethically, or reputationally. Here’s the short version.

1. Fairness

AI systems should treat people equitably, regardless of race, gender, age, or other protected characteristics. This sounds obvious until you remember that models learn from historical data, and history is full of bias. A hiring algorithm trained on decades of resumes will happily learn who used to get hired, not who should. Fairness means actively hunting for that kind of bias and correcting for it, rather than assuming a model is neutral because it’s “just math.”

2. Safety

Two questions sit at the heart of safety. Is the system reliable? And does it minimize harm? Reliability means the system behaves predictably. It doesn’t produce wildly different outputs for the same input, and it doesn’t fail in surprising ways. Harm minimization means thinking ahead about physical, psychological, and societal risks before deployment, not patching them after something goes wrong.

3. Privacy

Three ideas make up this principle: protect sensitive data, collect only what’s necessary, and secure it properly. The “collect only what’s necessary” piece is the one organizations most often skip. It’s tempting to hoover up as much data as possible because it might be useful someday. Responsible AI design resists that temptation and asks what’s actually required for the task at hand.

4. Transparency

This one splits into explainability and disclosure. Explainability is about the decision: if an AI system denies someone a loan or flags their content, can anyone actually explain why? Disclosure is about the interaction: does the person even know they’re talking to an AI in the first place? Both matter, and both are increasingly required by law, not just good practice.

5. Accountability

When something goes wrong, who’s responsible? That’s the entire principle in one sentence. It breaks into three parts: clear ownership of outcomes, meaningful human oversight so the system never runs fully unsupervised, and real processes to fix failures when they happen. A system with no accountable owner isn’t just risky, it’s ungovernable.

6. Human-Centricity

The last principle is really a check on all the others. Does the system enhance human capability, or does it quietly replace human judgment where judgment still matters? People should retain agency over the decisions that significantly affect their lives, and there should be meaningful human oversight for the decisions that carry the most weight.

Why this matters

None of these principles are novel in isolation. Fairness, safety, and accountability are old ideas. We’ve applied them to everything from food safety to financial regulation. What’s new is applying them to systems that make decisions at a scale and speed no human reviewer can fully keep up with.

The organizations that treat these six principles as a checkbox exercise tend to get burned. The ones that treat them as design constraints, baked in from the first line of code, not bolted on before a compliance audit, tend to build systems people actually trust.

You don’t need to memorize these in order. But if you’re building, deploying, or regulating AI systems, you need to know all six.

Join our free Lightning Lesson on Tuesday, September 1 at 2:00 PM PT:

How to Secure Agentic AI: A Practical Framework

We’ll move beyond principles and look at the practical controls needed when AI agents can access tools, data, applications, and take actions on behalf of people and organizations.

Register free:
https://maven.com/p/09acef/how-to-secure-agentic-ai-a-practical-framework

Yesterday, we covered six characteristics that make AI fundamentally different to govern:

Probabilistic. Opaque. Data-dependent. Complex. Autonomous. Fast and scalable.

Those characteristics help us understand the risks we can assess before deployment.

But once AI is deployed, a second set of governance challenges appears.

That is where DICES comes in:

Drift. Injection. Composability. Erosion of Oversight. Supply Chain.

These five characteristics explain why AI governance cannot end at approval.

D — Drift

An AI system can become less reliable even when nobody intentionally changes it.

The environment around it changes.

The data coming into the system may change. The relationship between inputs and outcomes may change. And externally managed models or services may also change over time.

This means a model that was acceptable when validated may not remain acceptable six months later.

I — Injection

Traditional software generally separates instructions from data.

AI systems blur that boundary.

Information provided to an AI system can potentially influence not only what it knows, but also what it does.

This becomes much more important with Agentic AI because agents may have access to tools, applications, databases, workflows, or other systems.

A prompt telling an agent not to perform an action is not the same thing as a technical control preventing that action.

C — Composability

Agentic AI systems rarely operate as isolated components.

An agent may call a tool. That tool may call another service. That service may rely on another model. The output may then become the input for another agent.

As the chain becomes longer, two things happen.

First, reliability can degrade across the system, even if each individual component performs reasonably well.

Second, accountability becomes harder to determine because responsibility is spread across models, tools, vendors, and organizations.

Governance therefore has to look beyond individual components.

E — Erosion of Oversight

One of the most common AI controls is:

“Keep a human in the loop.”

But having a human approval step does not automatically mean meaningful oversight exists.

Over time, people can become accustomed to AI recommendations, especially when outputs are confident, fluent, and consistent.

Review can slowly turn into confirmation.

The human may still click “approve,” but the actual judgment has effectively moved to the AI system.

That creates the appearance of human accountability without genuine human decision-making.

S — Supply Chain

Most organizations do not build every part of their AI systems.

They rely on foundation models, APIs, cloud platforms, datasets, orchestration tools, plugins, and other external services.

That creates a different kind of dependency.

You may not control how a model was trained, how its data was selected, how it was evaluated, or how it will change in the future.

But your organization may still be accountable for what the system does.

Supply-chain governance therefore becomes part of AI governance.

Why DICES Matters

DICES reveals an important shift in how we need to think about Agentic AI governance.

Traditional governance often asks:

Was the system reviewed before deployment?

Agentic AI requires us to ask:

How are we governing it while it is operating?

Because once an AI system is live:

• its environment can change,

• its inputs can influence its behavior,

• its actions can move across multiple systems,

• human oversight can weaken,

• and critical dependencies may sit outside the organization.

That means governance cannot exist only in policies, risk assessments, and approval documents.

It must also exist at runtime.

Controls need to monitor what the agent is doing, enforce what it is allowed to do, record what happened, and respond when something goes wrong.

That is the larger lesson behind DICES.

As AI becomes more autonomous, governance has to move closer to the point where AI actually takes action.

Monday: Principles of Responsible AI

Want to dive deeper? Join our upcoming cohort of AIGP (AI Governance Professional) Cert Prep + Agentic AI Governance Mastery Cohort. Use code AGENTIC for a limited time 30% discount.

https://maven.com/cyberedx/aigp?promoCode=AGENTIC

Most organizations have AI rules. Far fewer have AI governance.

The distinction is simple:

Governance = Rule + Verification + Consequence

A rule defines what is expected.
Verification determines whether the rule is being followed.
A consequence defines what happens when it is not.

Remove any one of the three and governance becomes little more than guidance.

Why Traditional Controls Are Not Enough

Traditional software controls are built around three assumptions:

• The system is deterministic — the same input produces the same output.

• The system is inspectable — engineers can examine the logic.

• The system operates slowly enough for human intervention.

AI challenges all three assumptions.

That is why AI needs a different governance model.

Six inherent properties explain much of the difference. Remember them as PODCAS.

PODCAS — What AI Is

P — Probabilistic

AI produces probabilities, not guaranteed answers.

Even a highly accurate model will sometimes be wrong. The important question is not simply how accurate is it? but:

When is it uncertain, where does it fail, and what happens when it does?

Governance shift: Define confidence thresholds, escalation rules, human-review requirements, and ongoing performance monitoring.

O — Opacity

AI decisions are distributed across enormous numbers of parameters rather than explicit rules.

There may be no identifiable line of logic explaining exactly why a particular output occurred.

Governance shift: Govern the inputs, outputs, decisions, evidence, and outcomes rather than relying only on inspection of internal logic. Decisions should be reconstructable after the fact.

D — Data Dependency

AI systems learn from data.

Poor, incomplete, outdated, biased, or unrepresentative data can directly affect model behavior.

The quality of the AI system is therefore inseparable from the quality of its data.

Governance shift: Treat data governance as part of AI governance. Monitor data quality, representativeness, provenance, bias, proxy variables, and changes in data over time.

C — Complexity

Modern AI systems contain enormous numbers of interacting components and parameters.

Behavior can emerge from those interactions in ways that cannot be predicted simply by inspecting individual components.

Governance shift: Move from primarily reviewing code to continuously testing behavior — including edge cases, adversarial scenarios, unexpected inputs, and production behavior.

A — Autonomy

AI agents can pursue goals, select actions, use tools, and make decisions with limited human involvement.

The system may find ways to achieve a goal that its designers never anticipated.

Governance shift: Define decision rights, permissions, boundaries, approval gates, escalation paths, and mechanisms to stop or override autonomous behavior.

S — Speed and Scale

AI can make and execute decisions at machine speed across thousands or millions of interactions.

Human review cannot be the primary control when the system operates faster than humans can react.

Governance shift: Governance itself must become automated. Use continuous monitoring, anomaly detection, automated guardrails, circuit breakers, and rapid rollback mechanisms.

The Core Idea

AI governance cannot simply copy traditional software governance.

AI is:

Probabilistic.
Opaque.
Data-dependent.
Complex.
Autonomous.
Fast and scalable.

Those properties do not automatically make AI dangerous.

They change how AI must be governed.

The controls have to be designed around the technology that actually exists — not the deterministic software systems organizations are accustomed to governing.

Tomorrow: Why AI Needs Governance? continued

Want to dive deeper? Join our upcoming cohort of AIGP (AI Governance Professional) Cert Prep + Agentic AI Governance Mastery Cohort. Use code AGENTIC for a limited time 30% discount.

https://maven.com/cyberedx/aigp?promoCode=AGENTIC

Most organizations have rules.

Far fewer have governance.

That distinction matters enormously as companies begin deploying AI systems and AI agents that can make decisions, access data, use tools, communicate with customers, and increasingly take actions on behalf of the organization.

Start with a restaurant

A restaurant does not stay open because the chef is talented.

It stays open because the kitchen runs on process.

Food is cooked to a defined internal temperature. Raw and ready-to-eat food are cut on different boards. The walk-in cooler stays below a set temperature. Every batch is labeled with a date.

None of that is culinary art. It is governance.

And notice what makes it real.

There is a written standard. There is a probe in the meat, a temperature log on the cooler door, and a health inspector who arrives unannounced. And when the log shows the cooler drifted overnight, the food goes in the bin, the line stops, the cook gets retrained — and if it keeps happening, the restaurant loses its license.

Rule. Verification. Consequence.

Remove any one of the three and you do not have a safe kitchen. You have a recipe binder and a hope.

The same is true for AI.

The Governance Equation

At its simplest, governance requires three things working together:

A rule.

A way to verify the rule is being followed.

A consequence when the rule is broken.

Remove any one of the three, and what remains is not governance.

It is a suggestion backed by good intentions.

1. The Rule

The first part seems obvious.

Organizations create policies, standards, procedures, and guidelines telling people and systems what they are allowed to do.

For example:

An AI agent may not send a customer refund above $1,000 without human approval.

That is a rule. It is the AI equivalent of “cook the food to 165°F.”

But writing it in an AI policy does not make it governance, any more than printing the temperature on a laminated card makes the chicken safe.

The organization still needs to answer a much harder question:

How do we know the agent actually follows it?

2. Verification

Governance needs evidence.

The kitchen has a probe and a log. What is the equivalent for the agent?

If an AI agent attempts a $5,000 refund, can the organization prove that the required approval occurred?

Can it identify:

• which agent initiated the action,

• what information the agent used,

• which policy applied,

• who approved the transaction,

• what action was ultimately taken?

If nobody can verify whether the rule was followed, the organization does not have a control.

It has documentation.

This is where many governance programs become fragile.

They define what should happen but cannot reliably demonstrate what did happen.

That difference may remain invisible for months.

Until something goes wrong.

3. Consequence

Even verification is not enough.

A cooler log that shows a temperature breach and changes nothing is worse than no log at all. It proves the organization knew.

Suppose the organization detects that an AI agent violated the $1,000 approval rule.

What happens next?

Does the transaction stop?

Does the agent lose permission to execute similar actions?

Does a human review the incident?

Does the event trigger escalation?

Does the organization change the system before allowing it to operate again?

A rule that can be violated repeatedly without consequence is not a meaningful rule.

Governance requires enforcement.

The equation, stated plainly

Governance = Rule + Verification + Consequence

Take away the rule and nobody knows what is expected.

Take away verification and nobody knows whether the rule was followed.

Take away consequence and there is little reason for the rule to matter.

All three have to exist together.

The Question Executives Should Ask

This creates a useful test whenever an AI system is approved.

Instead of asking:

“Do we have an AI governance policy?”

Ask:

“Show me the rule, show me how we verify it, and show me what happens when it is violated.”

If one of those answers is missing, governance is incomplete.

And approving the system anyway can create an illusion of control that may survive until the first serious incident, audit, or regulatory review forces someone to examine what was actually happening.

The dangerous part is not knowing that governance is missing.

The dangerous part is believing governance exists when it does not.

That is the gap organizations need to close as AI moves from systems that simply generate answers to systems capable of taking action.

Because once AI can act, governance can no longer live only in policies.

It has to operate where the action happens.

In the kitchen. On the line. In the runtime.

Tomorrow: Why does AI need Governance?

Got questions? Talk to my digital twin at cyberedx.com

Read free chapters of our ‘Governing Agentic AI: A Corporate Thriller. A Visual Playbook.’ : https://cyberedx.com/reader

Want to dive deep? Check out our upcoming cohort of ‘AIGP Cert Prep & Agentic AI Governance’ at https://maven.com/cyberedx/aigp?promoCode=AGENTIC

Subscribe to get all 100 days.

Today is Day 1 of our 100-day series.

We’ll start with the basics: What is AI, and how is it different from human intelligence?

How a human learns

Think about a delivery drivers on the same route for years.

They better by doing the job, failing at parts of it, and correcting himself — until the correction becomes instinct he no longer thinks about. Nobody handed them a manual listing every backup and every construction detour in advance. They built the knowledge the slow way, trip by trip.

And if you ask him how they know, they can roughly tell you.

How a machine learns

Now think about the navigation app on driver’s dashboard.

It never learned the road one trip at a time. It found its shortcuts by processing data from a few million other people’s trips and keeping whatever pattern predicted a faster route — without anyone writing that pattern down as a rule first.

Same road. Same shortcut. Completely different source of information.

The ladder most organizations are standing on

Organizations don’t run one kind of AI. They run four, usually at the same time, usually without a map.

Traditional AI follows fixed rules and answers the question it was built to answer.

Generative AI produces something new, on request — but still waits to be asked.

An AI agent completes a defined goal autonomously. You give it the goal; it figures out the steps, uses tools and data, and takes action.

Agentic AI keeps acting — decision after decision — long after the person who started it stopped paying attention.

Each rung up that ladder, the human moves further from the decision. Your controls have to move with it. Most haven’t.

Agent vs. agentic — the distinction that matters

People use these interchangeably. They shouldn’t.

An AI agent does the work. It can think, use tools, take actions, and adjust based on what happens.

Agentic AI is the bigger system around the agent. It brings together agents, tools, memory, and workflows so they can work toward a goal with minimal human intervention.

That’s not a semantic upgrade. It’s a different accountability problem. With an agent, you can still ask: was the output correct? With agentic AI, the honest question becomes: who is accountable for a chain of decisions no human observed, approved, or can reconstruct?

What the next 99 days look like

Core concepts of Agentic AI Governance. Real incidents. Practical controls. Regulatory risks. Frameworks you can actually put into practice.

Tomorrow: What Is AI Governance, and Why Do We Need It?

Got questions? Talk to my digital twin at cyberedx.com

Read free chapters of our ‘Governing Agentic AI: A Corporate Thriller. A Visual Playbook.’ : https://cyberedx.com/reader

Want to dive deep? Check out our upcoming cohort of ‘AIGP Cert Prep & Agentic AI Governance’ at https://maven.com/cyberedx/aigp?promoCode=AGENTIC

Subscribe to get all 100 days.

I’m excited to share that from tomorrow, I’m starting 100 days of practical lessons with on governing agentic AI - how to use AI agents safely, responsibly, and with clear accountability. No prior AI knowledge or coding skills required.

Why it matters

If you’re responsible for AI adoption at your company, this will sound familiar: you have a policy, legal signed off, everyone feels covered. Then someone asks which AI agent can commit your company to what — and who owns that. Silence. That gap is where almost every organization lives right now.

“Governance isn’t the policy. It’s the operating system that makes AI adoption possible.”

I’m Niharika Srivastav, AI Governance Practitioner, ex- Deloitte, KPMG, Bank of America, Blue Shield of CA, Stanford. Co-teaching with Sanjay Saxena - Chief AI Officer, Ex- KPMG, Deloitte, Harvard.

We focus on what actually works in practice - inventory, identity, risk, controls, evidence, and operating models. Over 100 days, you’ll get a practical framework, real-world incidents, and clear guidance you can use.

Ask yourself: could you name, right now, every AI agent in your company that can take an external action — and who’s accountable for it?

What’s next

Day 1 tomorrow: We’ll start with the basics. Evolution from Human Intelligence to Artificial Intelligence to Agentic AI

Talk to my digital twin — live, 24/7, multilingual. Ask her anything about AI Governance : cyberedx.com

First 2 chapters of the book — free, no email: cyberedx.com/reader

30% off the Maven course this week only: https://maven.com/cyberedx/aigp?promoCode=AGENTIC

New here? Subscribe to get every day delivered to your inbox.

If this resonated, restack it — it helps someone else find this series.

August 20, 2026

In an era where AI technologies are evolving swiftly, the significance of AI governance is more apparent than ever. With industries increasingly adopting AI tools, understanding how to manage these technologies responsibly is crucial. In our lightning lesson, John Rood , Sanjay Saxena and I discussed the essentials of AI governance, job opportunities in this field, how to build AI governance portfolio and prepare for an AI governance interview. Here is the recording : https://maven.com/p/1cb530/acing-the-ai-governance-interview

Understanding AI Governance

AI governance refers to the frameworks, regulations, and policies that ensure AI systems are safe, ethical, and operate within legal boundaries. Just as rules were established in the past to manage the risks associated with electricity, AI governance aims to create standards that allow AI to be beneficial while minimizing potential risks.

Why is AI Governance Important?

AI governance isn’t just about preventing minor mishaps—it’s about safeguarding entire systems. Without proper governance, AI systems might cause job losses from automated hiring processes, provide incorrect legal advice, or mishandle sensitive data, leading to severe financial and reputational consequences. Governments worldwide, from the EU to various US states, are implementing laws to mitigate these risks.

Career Opportunities in AI Governance

The field of AI governance is ripe with opportunities. There is a burgeoning demand for professionals who can navigate AI regulations without necessarily having technical coding skills. These roles span various levels and are available globally across sectors. LinkedIn is replete with titles like Principal AI Governance or Head of AI Governance, indicating the growing importance of this field.

Building Your AI Governance Portfolio

One critical aspect of entering the AI governance field is showcasing your expertise through a robust portfolio. This is especially essential for those transitioning from different careers, as AI governance roles are typically mid-career positions. Your portfolio should ideally include:

1. Expertise in Key Frameworks: Understand frameworks like the NIST AI Risk Management Framework and the EU AI Act.

2. Translation of Regulations into Controls: Be able to convert dense regulatory text into practical, implementable policies for organizations.

3. Inventory and Risk Management: Develop skills to create AI system inventories, evaluate risks, and conduct impact assessments.

4. Internal AI Use Policies: Demonstrate your ability to develop comprehensive AI use policies within organizations.

Preparing for the AI Governance Interview

When preparing for an AI governance interview, candidates should focus on demonstrating their ability to collaborate across various departments. Hiring managers often focus on your soft skills, such as communication and cross-functional collaboration. Familiarity with AI basics, global regulations, and standards is also essential. Interview questions may include scenario-based challenges or judgment questions to gauge your operational thinking and decision-making abilities.

Questions to Ask During Your Interview

When interviewing for AI governance roles, asking insightful questions can demonstrate your understanding and engagement with the field. Consider asking:

• “What is the current maturity level of your AI governance program?”

• “Who owns AI risk management in your organization?”

• “How are you preparing for upcoming AI regulatory changes?”

Embarking on Your AI Governance Career

Entering the AI governance field requires continuous learning and networking. Whether through formal courses or practical experience, knowledge of AI fundamentals, regulations, and governance is crucial. Building a solid portfolio and preparing effectively for interviews will position you for success in this burgeoning field. Whether you’re drawing policies from scratch with nonprofits or engaging in pro bono consultations, there’s always room to grow and make an impact.

This dynamic field of AI governance offers a golden opportunity to influence the future of AI integration in our daily lives and businesses. By staying informed and proactive, you can become a pivotal player in shaping AI’s role in society.

This is not another dense AI governance book.

It combines a corporate thriller, visual storytelling, real-world scenarios, and practical playbooks to explore one of the biggest questions facing professionals today:

How do you let AI act without losing control?

At the center of the book is VERDICT, our practical framework for governing Agentic AI across:

Validation • Evidence • Runtime Control • Decision • Identity • Cost & Compliance • Transparency

If you’re building, deploying, governing, or taking responsibility for AI agents, this book is for you.

The age of Agentic AI is here.

Now we need governance designed for it.

The book is available at a special launch price this week.

https://maven.com/cyberedx/o/343393

Here’s a sneak peek inside the book

We designed the book to make complex Agentic AI concepts visual, practical, and easy to understand.

Here are a few diagrams from the book:

You cannot govern AI systems you do not know exist. The ones doing the most damage are the ones nobody thought to report.

Week 1. Look where AI actually lives. Three places hold the real inventory, and none of them is the official list.

Your system logs: they show what is actually calling an AI model, regardless of whether anyone approved it.

Your vendor contracts: many software providers have added AI features to products you already own, and those systems count.

Your bills: cloud and AI subscription spend, broken down by team, will surface tools nobody disclosed.

Start there. The official registry is where you end up, not where you begin, because it only contains what people remembered to register.

Week 2. Count what is running, not what was approved. For every AI system you find, record five things: its name, its owner, its purpose, its permissions, and its current stage (pilot, production, or retired). Do not spend a month designing the perfect tracking template. A short list with five columns is more useful than an elegant system with fifty empty ones.

Week 3. Find the AI your employees brought in themselves. This is the step most organizations skip, and it is the one that causes the real damage. Check whether employees are using personal AI accounts on company data. Look at outbound traffic for connections to AI services the company never approved. Ask managers directly what tools their teams are actually using to get work done. You are not looking to punish anyone. You are finding the tools that spread because the approved option required a formal request and the deadline was Tuesday. Expect this step to grow your count more than any other.

Week 4. Rank the risk and name an owner. Give every AI system a risk level and one named human accountable for it. People will push back on being named. That pushback is the most valuable information you will collect all month, because the systems nobody is willing to sign for are exactly the ones that either need a signer fast or need to be turned off.

If you want to dive deep, join our AIGP Cert Prep + Agentic AI Governance Mastery Program : maven.com/cyberedx/aigp

The AI governance job market is booming and brutally selective.

Every week, LinkedIn floods with new AI Governance Lead, Responsible AI Manager, and AI Risk Officer postings. Salaries range from $150K to $400K+. And yet, hiring managers I talk to keep saying the same thing: “We’re drowning in applications. We can’t find anyone who can actually do the work.”

The gap isn’t demand. The gap is evidence.

Here’s how to close it, before your next interview.

Part 1: The Portfolio That Gets You Past the Résumé Screen

Résumés get you a callback. Portfolios get you an offer. Hiring managers, and Chief AI Officers Google you before the interview. If they find a Substack post and a GitHub repo full of impact assessments, you jump to the shortlist. If they find a certification badge and a job title, you’re just another candidate.

Build these ten artifacts. Publish them. Link them from your résumé and LinkedIn.

1. An AI System Inventory

Pick 5–10 real, hypothetical, or open-source AI systems. Document purpose, model type, data sources, risk tier, jurisdiction, and human oversight. Regulators start with “know what you have.” Most companies still don’t.

2. A Completed Impact Assessment

Choose a high-risk use case : loan approval, hiring, healthcare triage, insurance claims. Write an impact assessment covering scope, stakeholder mapping, harm identification, prioritization, mitigation, and residual risk. Map every mitigation to a specific EU AI Act, GDPR, or NIST AI RMF article. This alone opens doors.

3. A Policy-to-Controls Translation Matrix

Take one regulation. Build a table: Obligation → Control → Owner → Evidence → Frequency. Cover at least 15 obligations. This artifact gets you interviews because almost nobody has it. Legal teams and CAIOs are desperate for people who can turn Article into a Jira ticket.

4. A Hands-On Bias Audit

Grab a public dataset : Adult Census, COMPAS, German Credit, HMDA. Run a fairness assessment. Compute demographic parity, equalized odds, selection rates. Document findings and mitigations. Show you can read a confusion matrix.

5. An Agent Policy + Agent Charter Pair

Draft one enterprise agentic AI policy (the “constitution”) and one specific agent charter (the “individual configuration”). Cover risk tiers, tool access, kill switches, human review triggers, and decommission plans. Agentic AI is the fastest-growing governance gap. Templates are rare. Yours can lead the pack.

6. A Vendor Due-Diligence Questionnaire

Build a vendor risk assessment covering data provenance, fine-tuning transparency, model lineage, indemnification, subprocessors, incident SLAs, and EU AI Act GPAI compliance. Include a scoring rubric. Every enterprise is drowning in AI vendor risk.

7. An Incident Response Playbook

Define incident tiers (bias event, hallucination causing harm, data leak, model drift). Map notification chains, regulatory disclosure timelines, rollback procedures, and post-mortem templates. Everyone plans for prevention. Almost no one plans for failure.

8. A Cross-Framework Mapping

Build a visual crosswalk between NIST AI RMF, EU AI Act, ISO 42001, and OECD AI Principles. Every enterprise governance program lives at the intersection of these frameworks. Nobody has time to build this crosswalk. Yours can save them weeks.

9. Public Thought Leadership

Publish one substantive piece per week : a case study, a framework, a regulation breakdown. Write what you’d argue in a meeting with the stakeholders. A Substack or LinkedIn newsletter with original pieces beats every certification badge on the résumé.

10. Evidence You’ve Facilitated Real Work

Volunteer with a nonprofit or a startup needing AI policy help. Facilitate an AI governance workshop. Record a mock impact assessment review. Governance is a contact sport hiring managers want proof you’ve faced engineering pushback and legal skepticism, not just written documents in isolation.

Part 2: Interview Preparation : What They’re Actually Testing

AI governance interviews are structured differently than traditional risk, legal, or product interviews. Expect four distinct rounds, each testing a different muscle.

Round 1: The Screening Call : Can You Explain AI Simply?

The recruiter or hiring manager tests whether you can talk about AI without jargon. Practice explaining, in under 90 seconds each:

• The difference between supervised, unsupervised, and reinforcement learning

• What a foundation model is and why it matters for governance

• The difference between fine-tuning and RAG

• What “agentic AI” is and why it creates new governance problems

• Why AI is probabilistic and what that means for testing and validation

If you can’t explain these to a non-technical GC in plain English, you fail this round.

Round 2: The Regulatory & Framework Round

Expect scenario-based questions grounded in real regulations. Prepare deep familiarity with:

• EU AI Act: risk categories, provider vs. deployer obligations, high-risk system requirements (Articles 9–15), Fundamental Rights Impact Assessments (Article 27), GPAI obligations, Article 50 transparency

• NIST AI RMF: the four functions (Govern, Map, Measure, Manage) and how they map to your operational work

• ISO 42001: what an AI Management System is and how it differs from ISO 27001

• Sector regulations: ECOA/Reg B for lending, HIPAA for healthcare, NYC LL 144 for hiring, Colorado AI Act, Illinois BIPA

• GDPR intersection: DPIAs, automated decision-making rights (Article 22), special category data

Practice translating regulation into controls out loud. “How would you operationalize EU AI Act Article 14?” is a favorite interviewer question.

Round 3: The Case Study : Show Your Operational Thinking

You’ll be handed a scenario. “Our company just deployed a hiring AI. How would you assess it?” Or: “A vendor’s foundation model was found to have IP infringement. Walk us through your response.”

They’re testing whether you can:

• Ask the right diagnostic questions (What’s the use case? Who’s affected? What jurisdiction?)

• Structure your analysis using a recognizable framework (harm ladder, risk tiers, obligation-to-control)

• Prioritize under ambiguity (which risk gets addressed first, and why)

• Sequence controls correctly (impact assessment before deployment, monitoring after release, incident response ready)

• Name the stakeholders and their roles (legal, security, business owner, engineering, communications)

Rehearse three case studies out loud — loan approval, hiring AI, healthcare AI. Time yourself. Twelve to fifteen minutes each.

Round 4: The Executive & Cross-Functional Round

You meet the CAIO, CISO, GC, or business leaders. This round tests judgment, communication, and organizational fluency. Expect questions like:

• “Engineering says a control you’re proposing will slow their release by six weeks. How do you handle it?”

• “The business wants to deploy an AI tool that legal thinks is high-risk. Walk us through how you’d mediate.”

• “The board asks you: are we exposed on AI? How do you answer in 90 seconds?”

• “How do you get engineering, legal, and product to agree on a risk tier?”

The winning candidate here isn’t the smartest person in the room. It’s the one who sounds like an operator someone who has facilitated hard conversations before and has scars to prove it.

Part 3: The Questions You Should Ask Them

Interviews are two-way. Asking sharp questions signals seniority. Ask:

• What’s the current maturity of your AI governance program — greenfield, formalizing, or scaling?

• Who owns AI risk today — CIO, CISO, GC, CRO, or a dedicated CAIO?

• Where does this role sit in the org chart, and who does it report to?

• What’s the biggest governance gap you’re trying to close in the next six months?

• Do you have an AI inventory, and how is it maintained?

• How are you preparing for EU AI Act enforcement in 2026?

• What’s your incident response process when an AI system fails?

The answers tell you whether the role is real or theater. If they can’t answer any of these, the program is immature — which can be an opportunity or a landmine, depending on the mandate and executive support.

Part 4: The Common Mistakes That Kill Candidacies

Three patterns disqualify strong candidates.

Mistake one: Overweighting credentials. AIGP, CIPP, ISO 42001 lead auditor — all useful. None are sufficient. Certifications signal you invested in the field. They don’t prove you can do the work. Pair every credential with a portfolio artifact.

Mistake two: Speaking in principles, not mechanisms. “We should ensure fairness” is a dead answer. “I would run demographic parity and equalized odds tests using Fairlearn on the deployer’s population, document findings in the impact assessment, and set a monitoring threshold of 4/5ths approval ratio” is a hire-me answer.

Mistake three: Not understanding the business. AI governance exists to enable safe deployment, not to block it. Candidates who position themselves as “no” people lose to candidates who position themselves as “here’s how we get to yes safely.” Every interviewer wants the second person.

Part 5: The 30-Day Preparation Plan

If you have a month before interviews:

Week 1 — Portfolio foundation: Complete artifacts 1, 2, and 3 (inventory, impact assessment, policy-to-controls matrix). Publish them.

Week 2 — Technical fluency: Complete artifact 4 (bias audit) using a public dataset. Read the EU AI Act (Articles 6, 9–15, 27, 50) and NIST AI RMF playbook.

Week 3 — Case study rehearsal: Draft three case studies (loan, hiring, healthcare). Rehearse each out loud, timed. Record yourself. Refine.

Week 4 — Interview readiness: Complete artifacts 5, 6, and 7 (agent charter, vendor questionnaire, incident playbook). Do two mock interviews with a peer or a coach. Prepare six sharp questions to ask them.

The Bottom Line

The AI governance market rewards operators, not observers. Certifications get you in the door. Portfolio artifacts get you the offer. Case study fluency gets you the seat.

You don’t need to be the smartest person in the room. You need to be the one who has already done the work even if only for a fictional company or a nonprofit project. Evidence beats theory every time.

Build the portfolio before you need the job. Rehearse the case studies before the interview. Ask the questions that reveal whether the program is real.

Then walk in like you’ve done this before.

Ready to Build the Portfolio and Prep for the Interview?

If you want structured guidance, live cohort feedback, and portfolio-grade deliverables — plus preparation for the AIGP certification exam — the Agentic AI Governance Mastery program is designed for exactly this.

Over the course, you’ll build every artifact listed above alongside working practitioners, mock-interview with peers, and leave with a portfolio you can defend in front of any CAIO or GC.

Explore the course: maven.com/cyberedx/aigp

The window into AI governance is open. Walk through it, with evidence in hand.

In a rapidly evolving digital landscape, the emergent field of AI governance is creating a plethora of opportunities for those prepared to seize them. With the burgeoning demand for professionals who can navigate the complexities of AI systems, now is the perfect time to transition into AI governance, a career path that promises growth, relevance, and impact.

Why AI Governance?

AI governance refers to the establishment of rules, processes, and responsibilities to ensure AI systems are ethical, safe, and accountable. This governance is necessary to avoid the potential harms AI systems can inflict, such as data breaches, brand damage, and legal liabilities. It involves maintaining accountability in AI applications to maximize benefits while minimizing risks.

Understanding Governance: A Historical Perspective

Just as the development of the automobile led to the creation of the DMV and driving regulations, the rise of AI requires its own set of governance frameworks. Much like the governance models seen with cars and electricity, AI governance focuses on creating rules and standards to prevent misuse and enhance safety and accountability.

What is AI and AI Governance?

AI governance isn’t about managing teams of coders; it’s about ensuring ethical AI development. Human intelligence stems from learning via sensory inputs, while AI learns from large data sets processed through machine learning models. The issue is not just about teaching AI correctly, but also guarding against erroneous or malicious inputs.

The Rise of Agentic AI

AI has evolved from simple predictive models to sophisticated agentic AI, which mimics human decision-making capabilities. These AI agents can autonomously perform tasks, from booking flights to complex problem-solving, necessitating robust governance to prevent misuse.

AI Governance: A Growing Need

The demand for AI governance professionals is soaring. AI’s rapid adoption, along with regulatory pressures, is driving companies to hire experts who can navigate AI governance landscapes. European Union’s comprehensive AI laws exemplify the global shift toward regulated AI operations.

Golden Career Opportunities in AI Governance

More organizations are recognizing the importance of AI governance roles. From AI policy leads to governance analysts, these positions are pivotal in guiding AI systems towards ethical utilization. Many of these roles are not advertised publicly and require proactive discovery through networking and industry events.

How to Transition into AI Governance

• Learn AI Fundamentals: Gain a high-level understanding of machine learning, deep learning, and LLMs.

• Understand Laws and Regulations: Familiarize yourself with global AI-specific regulations and industry-specific laws.

• Delve into Standards and Frameworks: Learn frameworks that guide safe and ethical AI implementation.

• Learn to Operationalize AI Governance: Engage in interdisciplinary collaboration to build safe AI systems.

• Network and Gain Experience: Attend AI events, collaborate with industry professionals, and venture into AI governance practices through startups or consulting roles.

  

Ready to Start?

There are numerous resources available—from free online courses to comprehensive training programs. If you’re looking for structured, in-depth learning, training programs that offer certifications like AIGP (AI Governance Professional) can significantly expedite your transition.

In conclusion, AI governance is not just a profession but a necessity in our AI-driven world. Whether you’re worried about job security in the face of AI advancements or eager to be at the forefront of technological governance, transitioning into AI governance offers a path filled with opportunity and impact. Now is your chance to become a leader in this critical field.

Building real AI governance skills requires structured learning, practical exercises, and guidance from experienced practitioners.

If you’re serious about transitioning into AI governance or accelerating your career, join our upcoming AIGP Certification Prep + Agentic AI Governance Bootcamp.

Use promo code AGENTIC for a limited-time 30% discount.

Enroll here: https://maven.com/cyberedx/aigp?promoCode=AGENTIC

Conformity assessment is the mandatory gateway for deploying high-risk AI systems in the EU market. By August 2, 2026, every high-risk AI system must complete this process to legally operate.

What you’ll learn in this guide: The complete conformity assessment process from preparation through market launch, focusing on Annex VI (internal control) – the route 90% of organizations will follow.

Key takeaways:

Timeline: Expect 16-20 weeks for conformity assessment if your technical documentation and Quality Management System are already in place. If starting from scratch, add 6-12 months.

Core requirements: You must complete Annex IV technical documentation (typically 50-150 pages), establish a Quality Management System, conduct internal audits, issue an EU Declaration of Conformity, affix CE marking, and register in the EU database.

Critical dependencies: Don’t start until you’ve confirmed high-risk classification, built your system to near-completion, drafted 80% of technical documentation, and established your QMS. Starting prematurely wastes time and creates false compliance.

Common failure points: Organizations underestimate documentation requirements, skip human oversight testing, treat post-market monitoring as optional, and start too late. The average conformity assessment takes 4-5 months – plan accordingly.

Post-launch obligations: Conformity assessment isn’t one-and-done. You must maintain continuous monitoring, report serious incidents within 15 days, and repeat conformity assessment for substantial system modifications.

The bottom line: This is systematic, not mysterious. Follow the 13-step process in this guide, document thoroughly, and start now. Organizations that succeed with EU AI Act compliance aren’t those with the most advanced AI – they’re the ones who take governance seriously from day one.

Read this guide if: You’re a provider of high-risk AI systems, compliance officer preparing for August 2026, product manager launching AI in EU markets.

Introduction

If you’re deploying a high-risk AI system in or for the EU market, conformity assessment isn’t optional, it’s the law. By August 2, 2026, all high-risk AI systems must complete this process before market placement.

This guide breaks down exactly what you need to do, in what order, and what documentation you’ll need. No legal jargon. Just actionable steps.

What Is Conformity Assessment?

Conformity assessment is the formal process that proves your high-risk AI system complies with EU AI Act requirements (Articles 9-15). Think of it as your system’s “passport” to the EU market.

The outcome: An EU Declaration of Conformity and CE marking that legally authorizes deployment.

Who needs this: Providers of high-risk AI systems (classified under Annex III or Article 6).

Deadline: Must be completed BEFORE placing the system on the market or putting it into service.

Two Conformity Assessment Routes

The EU AI Act offers two paths. Most organizations use Annex VI (Internal Control) because it’s faster and cheaper.

Route 1: Annex VI – Internal Control (Self-Assessment)

Best for: Most high-risk systems

Requirements:

• Established Quality Management System (QMS)

• Complete technical documentation (Annex IV)

• Internal compliance verification

• Self-issued Declaration of Conformity

Timeline: 2-4 months (if documentation ready)

Route 2: Annex VII – Quality Assurance (Third-Party)

Best for:

• Systems where internal assessment credibility is questioned

• Organizations wanting external validation

• Certain high-risk categories requiring extra scrutiny

Requirements:

• Everything from Annex VI PLUS

• Notified Body assessment of QMS

• Periodic surveillance audits

• Third-party approved Declaration

Timeline: 4-8 months

This guide focuses on Annex VI (most common route).

Prerequisites: Before You Start

Don’t begin conformity assessment until you have:

✅ Risk Classification Complete: Confirmed your system is high-risk (Annex III)
✅ System Deployed/Near Deployment: Conformity assessment applies to real systems, not concepts
✅ Technical Documentation 80%+ Complete: Annex IV requirements mostly fulfilled
✅ QMS Established: Quality Management System in place (Article 17)
✅ Budget Allocated: Internal time + potential external audit costs
✅ Team Assigned: Cross-functional group (legal, engineering, compliance, product)

Time Warning: If you’re starting from scratch, add 6-12 months BEFORE conformity assessment begins.

Step-by-Step Conformity Assessment Process

PHASE 1: PREPARATION (Weeks 1-4)

Step 1: Assemble Your Conformity Assessment Team

Required Roles:

• Project Lead (owns timeline, coordinates workstreams)

• Technical Lead (AI/ML engineer who built the system)

• Legal/Compliance Officer (interprets requirements)

• Documentation Specialist (manages Annex IV creation)

• QMS Manager (oversees quality processes)

• Domain Expert (understands use case: HR, healthcare, finance, etc.)

Deliverable: RACI matrix showing who’s Responsible, Accountable, Consulted, Informed for each requirement.

Step 2: Conduct Pre-Assessment Gap Analysis

Review compliance against each Article:

Article 9 (Risk Management):

• Is there a documented, iterative risk management process?

• Have all reasonably foreseeable risks been identified?

• Are mitigation measures in place and tested?

• Are residual risks documented and accepted?

• Is there special consideration for vulnerable populations?

Article 10 (Data Governance):

• Are training, validation, test datasets documented?

• Is data representativeness assessed?

• Have biases been detected and mitigated?

• Are data governance procedures established?

• Are data quality metrics tracked?

Article 11 (Technical Documentation):

• Is Annex IV documentation complete?

• Is documentation version-controlled?

• Is it accessible to competent authorities?

Article 12 (Logging):

• Does the system automatically log events?

• Are logs tamper-proof?

• What is the retention period?

• Can logs trace decision lineage?

Article 13 (Transparency):

• Are instructions for use complete?

• Do they explain capabilities AND limitations?

• Are performance metrics disclosed?

• Is human oversight guidance provided?

Article 14 (Human Oversight):

• Are human oversight mechanisms designed into the system?

• Can humans override decisions?

• Is there a “stop” or pause function?

• Are operators trained on automation bias?

Article 15 (Accuracy/Robustness/Security):

• What accuracy levels are achieved?

• Has adversarial testing been conducted?

• Are cybersecurity controls documented?

• Is the supply chain secured?

Deliverable: Gap analysis scorecard with prioritized remediation items.

Step 3: Create Project Plan

Timeline backward from target date:

Target: System Launch Date
← Minus 2 weeks: Buffer for unexpected issues
← Minus 2 weeks: Final sign-off and Declaration issuance
← Minus 4 weeks: Internal audit and remediation
← Minus 8 weeks: Documentation finalization
← Minus 4 weeks: Gap closure (start of conformity process)

Deliverable: Milestones, owners, dependencies.

PHASE 2: DOCUMENTATION (Weeks 5-12)

Step 4: Complete Annex IV Technical Documentation

This is the most time-intensive step. Annex IV requires comprehensive documentation covering:

Section 1: General Description

• System name, version, intended purpose

• Provider information and contact

• Date of development and modifications

• Description of hardware and software environment

Section 2: Detailed Design

• System architecture and logic

• Methods and steps used in development

• Design specifications

• Description of system components

• Computational resources used

• Data requirements (formats, volumes)

Section 3: Data Governance

• Description of training, validation, test datasets

• Information about data provenance and acquisition

• Data preparation methodologies

• Labeling procedures

• Data augmentation techniques

• Assumptions about data quality and integrity

• Measures to detect bias

• Statistical properties of datasets

Section 4: Monitoring and Logging

• Description of capabilities for logging

• Information recorded during operation

• Retention periods

Section 5: Risk Management

• Description of risk management system (Article 9)

• Identified risks and mitigation measures

• Testing procedures and results

• Validation and verification methods

Section 6: Changes and Modifications

• Description of all changes made throughout lifecycle

• Assessment of changes’ impact on compliance

Section 7: Performance Metrics

• Accuracy, robustness, cybersecurity measures

• Expected performance across different operating conditions

• Performance metrics for different demographic groups

Section 8: Instructions for Use

• Identity and contact details of provider

• System characteristics, capabilities, limitations

• Intended purpose and contraindications

• Performance metrics (reference Article 13)

• Hardware and software requirements

• Installation instructions

• Expected lifetime and maintenance

• Human oversight measures

Practical Tips:

✅ Use templates: Don’t start from blank page. Adapt industry templates.
✅ Version control: Use Git or document management system.
✅ Cross-reference: Link sections (e.g., “See Section 3.2 for data bias mitigation”).
✅ Evidence-based: Include test results, not just claims.
✅ Plain language: Write for regulators, not just engineers.

Deliverable: Complete Annex IV technical documentation package (typically 50-150 pages).

Step 5: Finalize Quality Management System Documentation

Article 17 requires documented QMS covering:

1. Compliance Strategy

• Policy commitment to EU AI Act compliance

• Roles and responsibilities

• Escalation procedures

2. Design and Development Procedures

• AI system development lifecycle

• Stage-gate reviews

• Testing protocols

• Change management

3. Technical Documentation Management

• Document creation, review, approval workflow

• Version control procedures

• Access control (who can view or edit)

• Retention policies

4. Post-Market Monitoring

• Performance monitoring plan (Article 72)

• Incident response procedures

• Reporting timelines (15 days for serious incidents)

• Corrective action processes

5. Communication with Authorities

• Primary point of contact

• Procedures for responding to inquiries

• Cooperation protocols

6. Record-Keeping

• What records are kept and where

• Retention periods (minimum 10 years after system discontinued)

• Audit trail maintenance

Deliverable: QMS Manual (30-60 pages) with supporting procedure documents.

PHASE 3: VERIFICATION (Weeks 13-16)

Step 6: Conduct Internal Audit

Purpose: Verify compliance before finalizing Declaration.

Audit Process:

1. Pre-Audit Preparation (Week 13)

• Select internal audit team (should NOT be same people who built system)

• Develop audit checklist based on Articles 9-15

• Schedule interviews with system developers, data scientists, product managers

• Request evidence in advance

2. Document Review (Week 14)

• Review technical documentation (Annex IV) for completeness

• Check QMS procedures are implemented, not just documented

• Verify testing results support claims

• Assess risk management documentation

3. Interviews and Observations (Week 15)

• Interview engineers: “Walk me through the risk management process”

• Interview operators: “How do you override the system if needed?”

• Observe logging: “Show me logs from last week”

• Test human oversight: “Demonstrate the stop function”

4. Gap Identification

• Document findings: Compliant, Minor Gap, Major Gap, Non-Compliant

• Prioritize remediation (Major gaps equal blockers)

Deliverable: Internal audit report with findings and remediation plan.

Step 7: Close Gaps and Remediate

Address findings from internal audit:

For each gap:

• Owner assigned: Who fixes it?

• Remediation plan: What specific actions?

• Timeline: By when? (Critical path items first)

• Verification: How will we confirm it’s fixed?

Common gaps and fixes:

Gap: Risk management not iterative
Fix: Implement quarterly risk review process with documented outcomes

Gap: Data bias not quantified
Fix: Run fairness metrics (demographic parity, equalized odds) and document results

Gap: Human oversight unclear
Fix: Create operator manual with step-by-step override procedures plus training program

Gap: Testing insufficient
Fix: Conduct adversarial testing, edge case analysis; document in Annex IV

Gap: Instructions for use incomplete
Fix: Add performance limitations, failure modes, operating conditions to user manual

Deliverable: Evidence package showing gaps closed (updated docs, test results, training records).

Step 8: Final Compliance Verification

Cross-functional review meeting:

Attendees: All conformity assessment team members plus executive sponsor

Agenda:

1. Review internal audit findings and remediation evidence

2. Confirm all Annex IV sections complete

3. Verify QMS implementation (not just documented)

4. Assess residual risks (are they acceptable?)

5. Check registration readiness (EU database requirements)

6. Go or No-Go decision

Decision Criteria:

• All major gaps closed

• Technical documentation complete and accurate

• QMS operational (not just on paper)

• Evidence supports compliance claims

• Executive sponsor approves

Deliverable: Signed compliance verification memo.

PHASE 4: DECLARATION (Weeks 17-18)

Step 9: Draft EU Declaration of Conformity

Required Elements (per Annex V):

1. System Identification

• Name and type of AI system

• Version number

• Unique identification (serial number, batch, etc.)

2. Provider Information

• Name and address of provider

• Contact details

• Authorized representative (if provider outside EU)

3. Declaration Statement “This declaration of conformity is issued under the sole responsibility of [Provider Name]. The AI system described above is in conformity with Regulation (EU) 2024/1689 (EU AI Act) and, where applicable, the following Union harmonisation legislation: [list if applicable, e.g., Medical Device Regulation].”

4. References

• Harmonized standards applied (if any)

• Technical specifications used

• References to Annex III classification

5. Conformity Assessment Procedure “The conformity assessment procedure followed is set out in Annex VI (internal control).”

6. Signature

• Place and date of issue

• Name and function of signatory (must have authority)

• Signature

Practical Tips:

✅ Use official template: Download from EU Commission website
✅ Legal review: Have counsel approve before signing
✅ Translate if needed: If provider is non-EU, may need English plus local language
✅ Keep original: Must be available for 10 years after system discontinued

Deliverable: Signed EU Declaration of Conformity (2-3 pages).

Step 10: Affix CE Marking

Where CE marking appears:

• On the AI system itself (if physical product)

• On packaging

• On accompanying documentation

• In digital form (for software-only systems)

CE Marking Rules:

• Minimum height: 5mm (if physically affixed)

• Proportions must follow official design

• Visible, legible, indelible

• Followed by identification number (if Notified Body involved)

For software and digital systems:

• Display in user interface

• Include in technical documentation

• Reference in Terms of Service

Deliverable: CE marking applied to system and documentation.

PHASE 5: REGISTRATION (Week 19)

Step 11: Register in EU AI Database

When: Before or concurrent with market placement

Where: EU AI Database (maintained by European Commission) - exact portal TBD, monitor ai-act-service-desk.ec.europa.eu for updates

Required Information:

Provider Details:

• Legal name and registration

• Contact information

• Authorized representative (if non-EU)

System Information:

• AI system name and type

• Intended purpose

• Annex III classification justification

• CE marking details

Deployment Information:

• Member States where deployed

• Expected deployment date

• Deployer categories (if known)

Documentation References:

• Link to publicly available information (if any)

• Declaration of Conformity reference number

Process:

1. Create account in EU database portal

2. Complete registration form

3. Upload required documents (Declaration, summary)

4. Submit for approval

5. Receive registration confirmation

Timeline: Allow 2-4 weeks for registration processing

Deliverable: EU database registration confirmation number.

PHASE 6: MARKET PLACEMENT (Week 20+)

Step 12: Final Pre-Launch Checklist

Before deployment, verify:

• EU Declaration of Conformity signed and stored

• CE marking affixed

• EU database registration confirmed

• Technical documentation (Annex IV) complete and archived

• QMS operational and documented

• Instructions for use finalized and distributed to deployers

• Training provided to operators (human oversight)

• Logging and monitoring systems active

• Post-market monitoring plan implemented

• Incident response procedures communicated to team

• Contracts with deployers include AI Act obligations

• Insurance coverage reviewed (product liability)

Deliverable: Launch approval from executive sponsor.

Step 13: Launch and Document

On launch day:

1. Activate monitoring systems: Ensure Article 72 post-market monitoring begins immediately

2. Notify deployers: Send instructions for use and compliance obligations

3. Archive evidence: Store all conformity assessment records (10-year retention)

4. Announce internally: Communicate compliance achievement to organization

5. Update website and materials: Reference CE marking and compliance status

Deliverable: Launch communication and evidence archive.

Post-Launch: Ongoing Obligations

Conformity assessment isn’t “set and forget.” Maintain compliance through:

Continuous Monitoring (Article 72)

Monthly:

• Review performance metrics versus declared specifications

• Check for model drift or accuracy degradation

• Assess user feedback and complaints

Quarterly:

• Update risk management documentation with new findings

• Review incident reports

• Test human oversight mechanisms

Annually:

• Full QMS audit (internal or external)

• Update technical documentation for any system changes

• Reassess Annex III classification (regulations may update)

Incident Reporting

Serious incidents must be reported within 15 days:

What qualifies as “serious”:

• Death or serious injury

• Serious disruption of essential services

• Serious breach of fundamental rights

• Serious damage to property or environment

How to report:

• Through EU database portal

• Notify national competent authority

• Provide root cause analysis and corrective actions

System Updates

Substantial modifications require NEW conformity assessment:

What’s “substantial”:

• Changes to intended purpose

• Changes affecting risk level

• Changes to input data categories

• Architectural changes to model

Process:

• Assess if modification is substantial

• If yes: Repeat conformity assessment (streamlined if most docs unchanged)

• Update Declaration of Conformity

• Update EU database registration

Common Mistakes to Avoid

❌ Starting conformity assessment too late: Begin 6-8 months before target launch
❌ Treating it as “compliance theater”: Regulators will audit; evidence must be real
❌ Incomplete technical documentation: Annex IV is exhaustive; don’t skip sections
❌ No human oversight testing: Must demonstrate, not just describe, override capability
❌ Ignoring post-market monitoring: Ongoing obligation, not one-time effort
❌ Copy-paste documentation: Each system needs specific, truthful documentation
❌ Underestimating resource needs: Expect 200-500 hours of skilled labor
❌ No legal review: Declaration has legal consequences; get counsel approval

Resources and Templates

Official EU Sources:

• EU AI Act Full Text: artificialintelligenceact.eu

• AI Act Service Desk: ai-act-service-desk.ec.europa.eu

• European Commission FAQ: ec.europa.eu/commission/presscorner/detail/en/qanda_21_1683

Templates (When Available):

• Annex IV Technical Documentation Template

• EU Declaration of Conformity Template (Annex V)

• QMS Manual Template (ISO 42001-aligned)

• Internal Audit Checklist

Professional Support:

• IAPP (International Association of Privacy Professionals): AIGP certification and resources

• Notified Bodies: Search EU NANDO database when Annex VII needed

• Legal Counsel: Specialized in AI and tech regulation

Timeline Summary

Typical Duration: 16-20 weeks (assuming prerequisites met)

Phase 1 - Preparation: 4 weeks for team assembly, gap analysis, planning

Phase 2 - Documentation: 8 weeks for Annex IV completion, QMS finalization

Phase 3 - Verification: 4 weeks for internal audit, gap remediation, sign-off

Phase 4 - Declaration: 2 weeks to draft and sign Declaration, affix CE marking

Phase 5 - Registration: 2 weeks for EU database submission and confirmation

Add 6-12 months if starting from scratch (building QMS, creating technical docs from zero, closing major compliance gaps).

Final Checklist: Are You Ready?

Before beginning conformity assessment, confirm:

• System is definitively high-risk (Annex III classification documented)

• System is built or nearly complete (not conceptual)

• Technical documentation 80% or more complete

• Quality Management System established

• Risk management process operational (not just designed)

• Team assigned with executive sponsorship

• Budget allocated (internal time plus potential external costs)

• Timeline allows 4-6 months before required launch date

• Post-market monitoring plan drafted

• Legal counsel engaged for Declaration review

If you checked all boxes: You’re ready to begin.

If you missed 3 or more boxes: Address prerequisites first. Starting prematurely wastes time and creates false compliance.

Conclusion

Conformity assessment seems daunting, but it’s systematic. Follow these steps, document thoroughly, and engage stakeholders early.

The organizations succeeding with EU AI Act compliance aren’t the ones with the most advanced AI they’re the ones who take governance seriously from day one.

August 2, 2026 is coming. Start now.