Chains · AI governance

AI rules are multiplying. The evidence trail is not.

Most firms can list the AI laws that apply to them. Far fewer can show, for a given model in production, which control satisfies which requirement and where the proof sits. AI makes the silo problem worse: model risk, compliance, privacy, procurement and the business each own a piece, and no one owns the line between them. The chain gives them a new way of working: one line from each model to its proof that every function maintains.

Rule families in this chain

EU AI Act

Risk tiers, with employment and credit uses treated as high risk.

NIST AI RMF

Govern, Map, Measure, Manage.

SR 11-7

Model risk: development, independent validation, governance.

NYC Local Law 144

Bias audits and candidate notice for automated hiring tools.

State AI laws

Colorado's AI Act and others on algorithmic discrimination.

Worked example: an AI tool that screens job applicants

One requirement, followed all the way down. The weak link is the one most firms miss: the tool fell between functions and never made it into the AI inventory.

1 · RegulationNYC Local Law 144: an independent bias audit within the year before use, a published summary, and notice to candidates.
2 · PolicyAI use policy: every AI tool that affects people decisions is inventoried and reviewed before deployment.
3 · Risk categoryCompliance and conduct risk: discriminatory outcomes in hiring.
4 · Loss eventAdverse impact on a protected group, leading to a complaint, enforcement or litigation.
5 · Control weaknessHR bought the tool through a vendor contract. Procurement saw a software purchase, model risk never saw a model, and compliance never saw the hiring use. No audit was scheduled.
6 · ControlsAn AI gate in procurement, an annual independent bias audit, and candidate notice built into the application flow.
7 · Key risk indicatorShare of AI hiring tools in use with a current audit, and impact ratios below 0.8 for any group.
8 · EvidenceThe audit report, the published summary, notice records, and the inventory entry with its sign-off.

Why the weak link sits at step 5

Every function did its own job correctly. The failure sat between them. AI laws assume you know which models you run, so the inventory has to be fed by every function that can bring a model in, not only model risk.

The same chain, other AI uses

Credit decisions, fraud models and customer-facing chatbots follow the same eight links with different rules at the top.

Mapping your own AI inventory?

I'd enjoy comparing notes on how you trace models to requirements.

Start a conversation