AI you can answer for.

Probably, if you operate in Europe or serve European customers, and the obligations depend on what the system does rather than on where it was built. Transparency duties are already in force. We work out which category your use falls into early, because it changes what has to be documented and built.

Knowing what AI you run, what it touches, who approved it and what it did. That is an inventory, a review step before anything reaches production, immutable logs of what happened, and a named owner per system. Most of it is unglamorous record-keeping that only matters when somebody asks.

Badly designed governance will, which is usually why it gets bypassed. Done well it is a defined path to approval rather than an open-ended review, so teams know what evidence is expected before they start. The delay people resent is the uncertainty far more than the checks.

By measuring its outcomes across the groups that matter and publishing the method. Fairness has several definitions that cannot all hold at once, so the honest work is choosing which applies to your decision and saying why. A model nobody has tested this way has not been shown to be fair or unfair.

Enough to reconstruct a decision months later — the input, the model and version, the output, who saw it and what they did next. For anything affecting a person, that record is the difference between explaining an outcome and guessing at it. Logs are written to be immutable for the same reason.

Yes, and it is a common starting point. We look at what it does, what it can reach, how it was evaluated and what evidence exists, then report what would need to change for it to be defensible. Sometimes that is documentation; sometimes it is the architecture.