Building the Compliance Program

Every AI compliance program starts with the unglamorous artifact: a register of every AI system and use case — model, vendor, purpose, data touched, user population, risk classification, owner. This is what OMB requires of federal agencies, what the AI Act implicitly requires for classification decisions, and what every audit opens with.

The inventory is a living system, not a spreadsheet written once: new AI use must enter through an intake path, and each entry needs the fields that classification requires (use context, affected parties, data categories). You cannot classify what you haven't catalogued — and 'we didn't know that system was AI' is the first thing an incident exposes.