Design AI governance and audit for a regulated company

production, governance, compliance, audit

Prompt

Legal asks whether your company's customer-facing LLM feature, deployed to EU users, needs to comply with the EU AI Act, and whether you should pursue ISO/IEC 42001 certification. Design the governance and audit process that answers this on an ongoing basis, not just once.

Interviewer's answers to clarifying questionsopen after you have asked your own

What the feature does? Answers customer questions and takes some automated actions (account changes within limits); EU users are a meaningful fraction of traffic.
Current state? No formal risk classification has been done; legal has heard "ISO 42001" and "EU AI Act" used interchangeably internally.
Org structure? No single team currently owns "is this AI system compliant"; it's unclear who re-evaluates it when the feature changes.
Pace of change? The team ships prompt and feature changes to this system roughly weekly.
Ask? A process that produces a defensible answer today and keeps producing a correct answer as the system or the regulation's obligations change.

Follow-upsafter your high-level design

A new feature is added next quarter that takes a higher-stakes automated action. Who decides whether that changes the system's risk classification, and how fast?
Does passing an ISO 42001 audit mean the system is legally compliant with the EU AI Act? Explain precisely what each one actually certifies.
An obligation's enforcement date shifts, as has already happened with parts of this Act. How does your process stay correct without someone remembering to re-check annually?
Someone proposes "buy a compliance tool and call it done." What does that tool actually cover, and what does it not cover?

Answer first: out loud, on paper, or with the interview prompt above. Then compare with the rubric.