Topic
AI compliance for production AI systems
How to turn obligations, controls, evaluations, and evidence into a practical operating model.
Most AI compliance writing stops at policy. These essays start where policy ends: at the engineering layer where obligations become controls, controls get tested, tests produce evidence, and evidence survives an audit.
The framework below connects five objects into a single loop. Each essay explores one part of that loop in depth, with concrete patterns you can apply to production AI systems today.
The compliance loop
Obligation
Identify what the regulation actually requires. Not the full text — the specific duties that apply to your system's risk class and role.
Control
Design engineering controls that satisfy each obligation. Controls are not guardrails — they have owners, tests, and evidence.
Evaluation
Test each control with evals that run in production, not just staging. The eval gap is where most compliance claims fall apart.
Evidence
Produce audit-ready artifacts: traces, test runs, approvals, model cards, change logs. This is the evidence plane your system is missing.
Response
When something breaks, respond with structured incident management — not ad hoc firefighting. AI incidents require AI-specific playbooks.
Choose your starting point
Key essays
Mapping the EU AI Act to engineering evidence
How Articles 9-15, 26-27, and 72-73 translate into controls, evals, and evidence artifacts. With crosswalks to NIST AI RMF and ISO 42001.
ControlControls are not guardrails
Controls are engineering constructs with owners, tests, and evidence. Guardrails are runtime filters. The difference determines whether your system is auditable.
EvaluationThe eval gap
Why staging success does not predict production reliability, and what to measure instead.
EvaluationBuilding an eval harness that survives production
Declarative specs, loader/runner/scorer separation, and what production eval infrastructure looks like when built to last.
EvidenceAnatomy of an evidence pack
What a real audit-ready evidence package contains: traces, test runs, approvals, model cards, change logs, and sign-offs.
EvidenceWhat your agent logged vs. what the auditor needed
The gap between operational logging and audit-grade evidence, and what it costs teams when they discover the difference too late.
ResponseThe incident response gap in AI systems
Why traditional incident response does not work for AI systems, and what changes when the system that failed is probabilistic and continuously drifting.
WalkthroughFrom obligation to evidence in 90 minutes
A practical walkthrough of the full compliance loop applied to a single use case, from identifying the obligation to producing the evidence artifact.
Reference
EU AI Act controls reference
The full obligation-to-control mapping table. Click any row for interpretation notes, framework crosswalks, and source links.
ReferenceThe regulatory mapping table
The reference artifact from the EU AI Act essay turned into a usable table engineering teams can hand to legal.
ReferenceAI Compliance Glossary
A practical glossary for the concepts behind the LatentMesh operating model: obligations, controls, evaluations, evidence, and ownership.
ReferenceFramework Crosswalk
How the EU AI Act, NIST AI RMF, and ISO 42001 map to each other — and where they diverge.
ReferenceEvidence Pack Guide
What an audit-ready evidence pack should contain, who owns each piece, and how to avoid the most common failure modes.
New to LatentMesh? The reading list covers the full ten-essay series and all companion articles in order.