For your role

Policy and compliance

Turn the standards into obligations a regulator or a contract can enforce: mappings to the law, numeric targets for challenges, and clauses a vendor has to sign.

Which systems this is for

First steps, in order

  1. Review the regulatory crosswalks

    Line-by-line mappings from the EU AI Act, the NIST AI RMF, and ISO/IEC 42001 to controls a system can be tested against.

    View crosswalk matrix

  2. Set measurable targets for challenges

    Commit to numbers: how many challenges are upheld, how fast they are answered, and a promise that challenging a decision carries no penalty.

    Read the standard for challenge targets

  3. Draft contract clauses

    Before the system makes its first decision, the vendor agreement has to state what it may decide, on what evidence, and how its errors get fixed. Cite clause numbers, and require the vendor to deliver the records those clauses name at each release.

    Cite the standards in a contract

What to run, satisfy, and read

The diagnostics that show risk in this role's work, the standards that apply to it, and the reading behind them.

Diagnostics

Standards

Reading

What to attend to, and what to have in place

The parts of the method

  • Choose the standard your policy rests on, and the rights it protects.
  • Set out how each rule is enforced and where escalations go.
  • Write public summaries in the words people use to challenge a decision. Keep the glossary's defined terms in the policy text.

Once you adopt

Each line either exists or does not.

  • Give every right to challenge a named owner and a response deadline.
  • Define restitution pathways for harms that cannot be fully undone.
  • Set incident disclosure expectations for high-impact failures.
  • Name who must sign off before a halted system restarts.

Other roles

If that was not you

  • Engineering — You build or operate the system that makes the decision.
  • Audit and assurance — You verify someone else's claims from the evidence their system emits.
  • Operations — You run the appeals, the incident response, or the queues where the system's errors land.
  • Design — You shape the interface where a person meets the decision.
  • Research — You study these systems and publish about them.
  • Executive — You decide whether to deploy, and you carry the liability when it goes wrong.