First, the AI Exposure Snapshot shows you exactly where you stand — every model, scored, with a named list of what cannot be signed off. In two to four weeks you have the validation map you don’t have today.
What’s live today
What’s running without you
AI didn’t enter your enterprise through a single front door you controlled. It arrived in pieces — a copilot a product team shipped, an agent embedded in a workflow, a vendor model three layers deep in a process. Each one makes or influences decisions. Most of them were never independently validated.
You own the sign-off, so the question lands on you: for every model the regulator now expects you to validate, can you actually do it independently? Right now, for most of these systems, the validation either lives inside the team that built them — or doesn’t exist.
Whose problem this is
Why this is your exposure, not engineering’s
Those are different jobs — and the regulator treats them that way. A model can perform well on the team’s own metrics and still fail independent validation: no documented reasoning, no challenge to its assumptions, no evidence a control was applied by anyone outside the build. When the regulator asks for independent validation of an automated decision, “the model team checked it” is not an answer you can sign off. You need validation that is independent by construction.
Engineering owns whether the model works. You own whether it can be independently validated and signed off.
The five questions
What you cannot currently defend
For each model heading for sign-off, ask whether you could answer these tomorrow:
Has the model been validated by someone independent of the team that built it?
Can you explain why it made a specific decision?
Is there a validation record an auditor or the regulator would accept?
Has anyone tested how it fails — adversarially and at the edges, not just for accuracy?
Is its behaviour watched now, or was it validated once at launch?
How we close it