Govern AI guides

The EU AI Act (Regulation (EU) 2024/1689) is a regulation laying down harmonised rules on artificial intelligence. It uses risk-based duties: prohibited practices, high-risk systems, transparency obligations, and residual systems. This page is not legal advice and does not determine that the Act applies to YOU.

Article 113 of Regulation (EU) 2024/1689 staggers application: 2 February 2025 (prohibitions, AI literacy), 2 August 2025 (GPAI, governance, penalties), 2 August 2026 (remaining original duties), 2 August 2027 (Annex I high-risk). Not legal advice. Does not determine that YOU are bound in 2026.

Chapter V of Regulation (EU) 2024/1689 sets GPAI-model duties. Article 53 is the provider baseline: Annex XI technical documentation, Annex XII downstream information, a copyright policy, and a public training-content summary. Not legal advice. This page does not determine that YOU are a GPAI provider.

Chapter V of Regulation (EU) 2024/1689 classifies GPAI models with systemic risk under Article 51. Article 51(2) presumes high-impact capabilities when cumulative training compute exceeds 10^25 floating-point operations. Article 55 adds extra duties. Not legal advice. This page does not designate YOUR model.

Articles 3, 16, 25 and 26 of Regulation (EU) 2024/1689 split operator roles: provider, deployer, importer, distributor, and product manufacturer. Article 25 can treat a deployer as a provider after a substantial modification. Not legal advice. This page does not determine that YOU are any of those roles.

Articles 4, 14 and 26 of Regulation (EU) 2024/1689 set AI-literacy, high-risk human-oversight and deployer duties, only if they apply. ISO/IEC 42001:2023 is a standard, not a legal substitute for the Act. Not legal advice. This page does not determine that YOU have to stand up an AI management system.

Article 9 of Regulation (EU) 2024/1689 is a high-risk AI risk-management system, only if Article 6 applies. Article 55 is a separate GPAI systemic-risk track. ISO 42001 and NIST AI RMF do not discharge Article 9. Not legal advice. It does not determine that YOU have to run an RMS.

Article 11 of Regulation (EU) 2024/1689 is Annex IV for high-risk AI systems, only if Article 6 applies. Article 53(1)(a)–(b) is Annex XI and Annex XII for GPAI models. A model card is not Annex XI. Not legal advice. It does not determine that YOU have to produce those packs.

Article 53(1)(d) of Regulation (EU) 2024/1689 is a public training-content summary for GPAI providers, according to the AI Office template. Article 50 is a different duty: labeling and marking AI-generated content. Not legal advice. This page does not determine that YOU have to publish a summary.

Article 53(1)(c) of Regulation (EU) 2024/1689 is a GPAI-provider policy to comply with Union copyright law, including DSM Directive Article 4(3) TDM reservations. Not legal advice. This page does not determine that YOU have to adopt a copyright policy.

Articles 73 and 55 of Regulation (EU) 2024/1689 are distinct serious-incident duties: high-risk systems to market-surveillance authorities on 15/2/10-day clocks, and systemic-risk GPAI to the AI Office without undue delay. Not legal advice. This page does not determine that YOUR event is a reportable serious incident.

AI-generated code is neither inherently secure nor insecure. Risk concentrates in failure modes your controls must catch — injection, secrets, insecure defaults, and hallucinated dependencies. This page is not legal advice.

Combine vulnerability findings, dependency exposure, review coverage, authorship share, and change-failure signals into a trended risk view for YOUR repos. Thresholds below are recommendations, not industry standards. Not legal advice.

Reliable detection uses provenance and telemetry you control — commit markers, tool logs, IDE attribution. Statistical classifiers are probabilistic and carry false positives and false negatives. This page is not legal advice.

Define the denominator first — lines, commits, or pull requests — and use provenance markers, not classifiers alone. Authorship share sizes exposure and review load; it is not a developer performance metric. Not legal advice.

Evidence on AI-assisted coding and technical debt is mixed and mostly correlational: higher short-term output can raise churn and rework unless you measure debt, enforce review, and pair speed with quality gates. This page is not legal advice.

AI coding ROI is net value after full cost: tool licences, extra review, security remediation, and training — compared with throughput and cycle-time gains you can attribute defensibly. Lines of code and suggestion acceptance rate are not ROI. This page is not legal advice.

Measure developer productivity at team and system level with DORA delivery outcomes and SPACE dimensions — never rank individuals on AI output. McKinsey and DX productivity claims are opinion, not standards. This page is not legal advice.

Catch AI-introduced defects with the same SDLC scanners you already run — secret, SAST, DAST, dependency, and config checks — plus prioritisation using KEV, EPSS, and CVSS on findings from agent-authored merges. This page is not legal advice.

An AI coding governance checklist covers approved tools, provenance, review gates, secret and IP handling, and framework mapping. Rows map to ISO/IEC 42001, NIST SSDF, and NIST AI RMF. EU AI Act duties appear only where applicable. This page is not legal advice.

An AI coding policy defines scope, approved tools, data and IP rules, review and provenance requirements, exceptions, and review cadence. Clauses below are marked mandatory or recommended. This template requires legal review — it is not legal advice.

Review agent-generated pull requests with a risk-tier decision tree: change type sets required review depth, automated gates, and merge criteria. Use the reviewer checklist below. Distinguish org best practice from ShipReady Metrics recommendations.

Measure technical debt with multiple proxy signals — code churn, complexity, defect density, and remediation cost — and track trends together. No single metric is authoritative. Each proxy has blind spots; combine evidence instead of one headline number.

Engineering excellence is delivery throughput and stability (DORA), developer experience and outcomes (SPACE), reliability practice (SRE guidance), and product quality (ISO/IEC 25010) read together — never a single KPI. This page is industry guidance, not legal advice.

DORA metrics are four software-delivery measures from the DevOps Research and Assessment program: deployment frequency, lead time for changes, change failure rate, and time to restore service. Recent reports add reliability. Not the EU DORA regulation.

An engineering risk score combines delivery, security, debt, lifecycle, and AI-adoption signals into one coverage-weighted view. ShipReady Metrics publishes its methodology; the score is an SRM measurement, not an industry standard or audit opinion.

ShipReady Metrics reports AI ROI, delivery (DORA), AI-authored-code share, per-committer metering, and a coverage-weighted engineering risk composite from connected systems — labeling gaps Not measured and figures as estimates, not audited financials.

Regulation (EU) 2024/1689 has no article headed 'keep an inventory'. Articles 49 and 71 with Annex VIII set an EU-database registration duty for certain high-risk systems; ISO/IEC 42001:2023 asks for a register as practice. Not legal advice. Recording a row is not registration.

Article 14 of Regulation (EU) 2024/1689 requires high-risk systems to be effectively overseen by natural persons; Article 26(2) requires deployers to assign that oversight to competent people. ISO/IEC 42001:2023 accountability is a standard. Not legal advice. Naming an owner is not Article 14 compliance.

Regulation (EU) 2024/1689 sets two different retention numbers: Article 18 keeps listed documentation at the disposal of national competent authorities for 10 years, and Article 19 keeps automatically generated logs for at least six months. Not legal advice. Not YOUR retention schedule.

Readiness under Regulation (EU) 2024/1689 is not one deadline. Article 113 staggers it: 2 February 2025, 2 August 2025, 2 August 2026, and 2 August 2027 for Article 6(1). Not legal advice. This page does not determine that the Act applies to YOU.

Two different things get called an audit. Under Regulation (EU) 2024/1689 authorities can compel documentation, logs and, on conditions, source code. A certification auditor asks by contract and standard. Not legal advice. This page is not a regulator filing pack.

It holds an org-authored AI inventory, an AI risk register, an obligation map, policies, and collected evidence with a human review overlay. It does not determine that Regulation (EU) 2024/1689 applies to you. Not legal advice. Compliance is not bought with a subscription.

An administrator registers each AI system by hand, with its declared tier, use case, role, GPAI flags, owner, and artefacts. Shadow-AI signals can propose a system, never classify it. There is no auto-discovery of every model. Not legal advice.

The AI risk register lists AI-specific risks an Article 9 or ISO 42001 assessment would consider, and shows whether the governance obligations that mitigate each are met across the registered high-risk inventory. Where nothing is covered it reads not verified. Not legal advice.

It measures a git-marker floor for the share of merged lines authored by AI, reconciles it against a figure your team types, and meters per committer. No article of Regulation (EU) 2024/1689 requires this. It is engineering-governance signal. Not legal advice.

Artefacts are collected, a human reviewer can accept one as meeting a control, and the result can be exported or shared as a posture snapshot. That is a recorded human judgement over your own records. It is not legal conformity. Not legal advice.

Articles 15 and 55 of Regulation (EU) 2024/1689 are distinct cybersecurity duties: high-risk systems for accuracy, robustness and cybersecurity, and systemic-risk GPAI for the model and its physical infrastructure. Not legal advice. This page does not determine that YOUR system must meet Article 15 or Article 55.

Regulation (EU) 2024/1689 splits evaluation in two: Article 15 is high-risk accuracy, robustness and cybersecurity, declared in the instructions for use; Article 55(1)(a) is GPAI systemic-risk model evaluation including documented adversarial testing. Not legal advice. It does not start a clock.

ISO/IEC 42001:2023 is the international management-system standard for governing AI. An AIMS is policies, roles, and controls; certification is optional third-party attestation. Not legal advice.

Get ISO 42001 certified by building an AIMS, then passing Stage 1 documentation and Stage 2 implementation audits with an accredited certification body. Cost and timeline vary by scope. Not legal advice.

Nobody is legally required to adopt ISO 42001 — it is voluntary. Pursue it when contracts, buyers, or risk posture warrant a certifiable AIMS. EU AI Act duties are separate law. Not legal advice.

An ISO 42001 readiness checklist maps clauses 4–10 and Annex A themes to checkbox items before Stage 1. Required-by-standard items differ from recommended practice. Not legal advice.

ISO 42001 certification uses Stage 1 documentation review, Stage 2 implementation audit, then a three-year certificate with annual surveillance. NCs require CAPA. Not legal advice.

ISO 42001 auditors sample documented information and records showing the AIMS operates — not just policies. Map clauses and Annex A controls to artifacts and owners. Not legal advice.

ISO 42001 Annex A defines nine AI control areas. Each has a control objective to address if applicable in the SoA; implementation is the organisation's choice. Not legal advice.

ISO 42001 governs an AI management system; ISO 27001 governs information security. Both use Annex SL clauses 4–10 and are certifiable — but scopes and Annex A themes differ. Not legal advice.

ISO 42001 is a voluntary management-system standard. The EU AI Act is binding Union law where it applies. They overlap in governance themes but do not substitute for each other. Not legal advice.

No — not as a general rule. ISO 42001 certification does not make you EU AI Act compliant. A certificate attests an AIMS; the Act imposes separate legal duties. Not legal advice.

Choose an ISO 42001 CB by verifying accreditation on IAF CertSearch or a national AB register, then evaluating scope, geography, and audit team competence. Not a ranking. Not legal advice.

An AI governance audit checklist spans inventory, risk, transparency, and lifecycle controls — labelled by source: ISO 42001, NIST AI RMF, or EU AI Act. Not legal advice.

ShipReadyMetrics maps shipped capabilities to ISO 42001 clauses — evidence collection, crosswalk, AI inventory, and risk register. Tooling supports audit prep; it does not certify. Not legal advice.

The EU AI Act (Regulation (EU) 2024/1689) is the first comprehensive AI law. It classifies AI systems by risk — unacceptable (banned), high-risk, limited, and minimal — and places the heaviest obligations on providers and deployers of high-risk systems, phased in between 2025 and 2027.

ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It gives organizations a certifiable framework to govern how they develop and use AI responsibly — using the same Plan-Do-Check-Act structure as ISO 27001, plus AI-specific Annex A controls and an AI system impact assessment.

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary, sector-agnostic framework for identifying and managing the risks of AI systems. It is organized around four functions — Govern, Map, Measure, and Manage — and a set of trustworthiness characteristics a system should exhibit.

The Colorado AI Act (Senate Bill 24-205) is a state consumer-protection law governing high-risk artificial intelligence systems — those that make, or are a substantial factor in making, a consequential decision about a consumer. It requires developers and deployers to use reasonable care to protect consumers from algorithmic discrimination.

AI governance is shifting from annual, point-in-time audits toward continuous, machine-verifiable assurance — driven by a paradox: the AI systems now writing code increasingly help review and govern it. This guide traces how law and measurement co-evolve, and what independent evidence means when the reviewer may itself be a machine.

AI governance software is the system of record for how an organization builds, deploys, and oversees AI: it inventories AI systems, classifies each by risk and context of use, enforces human oversight, and holds provenance and evidence that regulators — and your own auditors — can independently check.