Library
White paperMichael Clark
Shipping Defensible AI
Evidence assembled for questionnaires leaves an AI software vendor unable to say what was true of which release. Three EU regimes (CRA reporting, the 2024 Product Liability Directive and the AI Act's high-risk regime) now turn each gap into a specific cost, and the UK is moving the same way. Vendors should treat compliance evidence as a build output, sealed at the release gate with the version of the law in force, with a per-obligation duty split and a per-release assurance pack, starting with a CRA runbook, a manifest for every release and a sealed release position.
Key findings
- Description-based assurance, such as questionnaire answers and model cards written at launch, leaves a vendor unable to say what was true of which release.
- Three EU regimes now turn evidence gaps into costs: CRA reporting since 11 September 2026, the PLD for products placed after 8 December 2026, and AI Act high-risk rules from 2 December 2027.
- The duty split between vendor and customer must be computed per obligation and stated per release, because no upstream assurance discharges a deployer's operational duties.
In the paper
- Three EU regimes, in sequence
- The same five questions
- Evidence as a build output
- Computing the duty split
- The cost arrives commercially first
- Where to start
Michael Clark
Chief Executive Officer, Standard Intelligence
Your next step