The compliance checklist for taking AI to production

A pilot lives in a forgiving world. It runs for a few people, on a slice of data, where a compliance gap is a private embarrassment at worst. Production is a different country. The feature touches real customers and real regulated data, and every gap you deferred is now visible to the people whose job is to find it. Most compliance failures are not surprises. They are known gaps that were fine in the pilot and fatal in production.

The clock is real. EU AI Act enforcement lands in August 2026, and vague answers about what your AI does and touches stop being acceptable. A checklist you run before launch is cheaper than an enforcement action you answer afterward.

The lesson from a regulated launch

A senior technical product manager described her most formative launch: a price-transparency product built while the regulation it served was still evolving. She was shipping into the No Surprises Act, a moving target, and the lesson she took from it was direct. In regulated spaces, compliance and product thinking have to be integrated from day one. You cannot build the product and then make it compliant. The compliance requirements are product requirements, and treating them as a later phase just guarantees rework.

She also described a habit from working at scale: sorting decisions into one-way and two-way doors. A two-way door is reversible, so you move fast. A one-way door is not, so you slow down and get it right. Compliance decisions in production are almost all one-way doors. Once you have processed customer data the wrong way or shipped a feature that violates a rule, you cannot quietly undo it. The checklist exists to make sure you treat the one-way doors like one-way doors before you walk through them.

Clarity compounds, and so does its absence

Her phrase for the pre-work was that clarity compounds. Time spent getting the requirements straight before building pays back many times over, and skipping it just creates rework later. Compliance is the sharpest version of that. A requirement caught before the build is a design input. The same requirement caught in production is a recall.

The checklist before you flip the switch

Before an AI feature reaches production, these should all have answers, not intentions:

Data handling is documented. What personal or regulated data the feature touches, and the legal basis for it.
The AI inventory is complete. With enforcement arriving, an accurate record of what the system does is itself required.
Decisions are explainable and logged. If a regulation demands you justify an output, you can, from the trail.
Human review sits on the one-way doors. The irreversible decisions have a person in the loop.
Ownership and response are named. Who is accountable, and what happens when something goes wrong, written down.

If any line is a shrug, the feature is not ready for production, no matter how good the demo looked.

How we approach it at Density Labs

In the AI Readiness Assessment, our $2,500 front door, we run the compliance gaps that stand between a pilot and production before you commit to the launch. We map the regulated data, the required inventory, the explainability and logging, and the human checks on the irreversible decisions. It is a focused engagement that turns a pile of deferred questions into a checklist you can actually clear, which is a great deal cheaper than clearing it in front of a regulator.

The pilot got away with the gaps. Production will not. Close them on your schedule, not someone else’s.

Compliance is a product requirement wearing a legal costume. Build it in, or build it twice.