What should an engineering team do now to prepare for AI regulation?
Build three artefacts: an inventory of what your AI systems are and what data each can reach, request-level traces you can replay, and evals that document how you know the system works. Every regime currently in force or in draft asks some version of those three questions. Teams that have them treat compliance as reporting; teams that do not treat it as a project.
Start with the inventory, because it is the one that requires organisational rather than engineering effort and therefore takes longest.
Resist building compliance-specific infrastructure. The traces that satisfy an auditor are the same traces that let you debug a production incident, and the evals that document reliability are the ones that catch regressions. Anything built purely for compliance tends to rot.
This is a description of engineering practice, not legal advice — take the specific obligations for your jurisdiction and risk tier from counsel.
Written by Binary AI Labs · Reviewed