Operating model & engagement

Compliance readiness

Classify the modeled use case, inspect its controls and keep evidence gaps visible.

Current decision

High risk · 6 control gaps

High risk: decisioning on people or essential services with sensitive data (finserv overlay applies).

Review each modeled obligation, mark evidence status and download the packet for qualified review.

Same instrument · 3 industries choosing a scenario replaces its inputs; save or share your current changes first

Next evidence action

Risk management system (documented, iterative)

Controls are self-declared scenario inputs. A marked checkbox is not an independently verified control or legal approval. The evidence reference date above remains visible.

Function

Autonomy

Data

User impact

Classification

High risk

High risk: decisioning on people or essential services with sensitive data (finserv overlay applies).

Audit readiness45%

Required controls · tap to mark in place

or print this page (⌘/Ctrl P) for a PDF.

6 controls still open

Every open control here is cheaper to design in now than to retrofit after launch. Sequence the gaps into the build plan, not a pre launch scramble.

If you act on this · the call → expected lift → how you'd measure it

The call

Identify the risk tier and required controls before delivery commits to a release path.

Expected lift · illustrative

Reduces late compliance rework by embedding control thinking into solution design.

How you'd measure it

Control coverage, unresolved gaps, audit readiness, time to compliance review, release blockers.

Steering committee takeaway: Compliance is not a gate at the end. It is a design input at the start.

Resume echo, regulated industry delivery across AMEX, Morgan Stanley, and S&P/CRISIL.

How this is built

Tier = the function's base class, escalated by rights affecting impact and by sensitive data + autonomy. Controls are the tier's obligations (EU AI Act structure) plus a finserv overlay when data is sensitive; readiness = controls in place ÷ required.

Classification logic dated July 2026 as obligations phase in. Stack: Next.js (static) + shared design system; client side.

Illustrative, not legal advice. The tiering and controls are simplified for portfolio demonstration and should be validated with counsel, risk, compliance, and policy owners for any real deployment.

Method, evidence and limitations

Prefer to read? The two minute case study · problem → approach → metric → outcome

Problem

AI initiatives need control requirements early enough to influence scope, data handling, review design, documentation, and release planning. Treating compliance as an end gate creates avoidable rework and risk.

Approach

The navigator classifies representative AI functions into simplified risk tiers, applies selected overlays, maps required controls, identifies gaps, and produces an audit readiness view.

Why this way

This connects AI delivery to regulatory exposure, auditability, control design, release readiness, and risk ownership.

The metric

Risk tier; control coverage versus what the tier requires.

The trade-off

Control burden and time to market versus regulatory and reputational exposure.

Outcome

A risk tier and required controls map with the gap to close before go live.