Compliance as a ready-made recipe, not a project to build
The third episode of the series “Four questions before choosing an AI environment” looks at the one thing AI tools will not do on their own: provide evidence for an auditor. We show what needs to be on the table — and how much of that work can be done before you even begin.
AI tools can now do almost everything a user asks for. But there is one thing they cannot do that an auditor asks for: provide evidence that the system is operated in accordance with regulations. This is not a criticism of the tools — compliance simply is not a software feature. It is a set of decisions, roles, procedures and records that someone has to put in place. The only question is: a blank sheet or a ready-made recipe?
A recipe instead of a blank sheet
In this episode, we discuss three things:
What must be on the table — regardless of the provider: a risk assessment, system classification, technical and decision documentation, human oversight, assigned responsibilities, a system register, an incident procedure and an audit trail that allows an individual response to be reconstructed months later. Add to that a timeline that will not stop: DORA, NIS2, data protection — some obligations under the AI Act already apply, and further deadlines extend into 2028.
CDF: methodology as part of the product, not an additional service — a ready-made path from requirement to evidence: what needs to be done, who approves it and what evidence remains. We show CDF Platform in practice: from a requirement in the Compliance Matrix, through a task in the planner and ready-made artifact templates, to an implementation dashboard where approval is a prerequisite for moving forward. What remains at the end is evidence, not a declaration.
We follow the same path ourselves — Bureau Veritas Polska has issued allclouds.pl an ISO/IEC 42001 certificate, the standard for artificial intelligence management — the first certificate for this standard issued by Bureau Veritas in Poland. We provide business and enterprise support — there is an entity responsible for the whole solution that can be identified in the documentation as accountable.
Six questions for every provider
The episode closes with six questions about compliance — for every provider, including us. In multi-year contracts, one question is often decisive: who will adapt the solution when regulations change — and at whose expense? That is a cost you will not find in any offer.
Finally, a business argument, not a formal one: an organization with well-organized documentation, a register and assigned responsibilities deploys new AI use cases faster. The first implementation builds the road — every subsequent one travels it faster. Compliance is not something you buy after implementation. It is the way you implement.
In the fourth and final episode: freedom of choice — models, providers and ways of working.
Four questions before choosing an AI environment
- How much does it really cost?
- Where are the organization's data, code and competitive advantage?
- Do you get compliance as a ready-made recipe, or do you have to build it as a separate project?
- Will you still be free to change your model, provider or way of working in two years?
VIDEO · EPISODE 3
Compliance as a ready-made recipe, not a project to build
Episode 1: How much does an AI environment really cost?
Episode 2: Where are the data, the code and your competitive advantage?