Build compliance timeline and checklist — lab audio overview

Host: Welcome back. You're in GenAI Evaluation, Safety and Governance — a course about making sure the AI systems your team ships are not just clever, but responsible, auditable, and legal. This chapter is on the European Union's AI Act. And the specific skill you'll practice today is tracking which rules apply to your systems, by what date, and whether you're actually ready. Let's set the scene first — why does this matter right now? Expert: So picture this. You're on the AI platform team at a mid-sized company — maybe a hundred engineers, a few AI-powered features shipping to customers in Europe. Your legal team forwards an email that says: "The EU AI Act is now in force. Penalties are active. Please confirm we are compliant." And suddenly everyone is staring at each other. Because the AI Act isn't one deadline — it's a staircase of deadlines stretching from February 2025 through August 2026, each one turning on different requirements. Some rules apply to banned uses of AI, like social scoring. Some apply to what are called general-purpose AI models — the large foundation models. Some apply to high-risk systems, meaning AI used in hiring, credit scoring, medical devices, and so on. The penalties are serious — up to seven percent of global revenue. Without a clear, living checklist that says "here's what applies to us, here's where we stand, here's the evidence," teams drown in spreadsheets and Slack threads. That's the gap this exercise fills. Host: Okay, so this is the first exercise in a three-part sequence on the AI Act. There's no previous lab to build on — this is your starting point. The chapter overview walked through the big picture of the regulation. Now you're getting concrete. So what exactly will we build today? Expert: You're going to build what I'll call a compliance tracker — a piece of code that acts like a structured, queryable to-do list for the AI Act. Think of it as the smart version of a compliance spreadsheet. Inside it, you'll represent the four major enforcement milestones — February 2025, August 2025, February 2026, and August 2026. Each milestone is a deadline on that staircase I mentioned. For each milestone, you'll store the specific requirements that kick in on that date — things like "prohibited AI practices must be stopped" or "general-purpose AI model documentation must be published." For each requirement, you'll track three things: the current status — whether it's done, in progress, or not started; a link to evidence — a document, a policy, an audit report that proves you did the work; and a remediation priority — how urgent it is to fix if it's not done. Then you'll add the ability to ask questions of this tracker. Things like: "Show me everything due by August 2025." Or: "What's our overall compliance score right now, as a percentage?" Or: "Which items are overdue and high priority?" That's the thing you're building. Host: Good. And what's the key idea — the conceptual shift someone needs before they sit down to write this? Expert: The key idea is that compliance is not a document — it's a data structure. Most teams treat regulation like a PDF you read once and file away. But regulations like the AI Act are actually a graph of obligations with deadlines, owners, evidence, and status. The moment you model it that way — as structured data you can query — everything changes. You can generate reports automatically. You can wire it up to monitoring later. You can show an auditor, in thirty seconds, exactly where you stand. So as you're coding, keep asking yourself: "If a regulator walked in tomorrow, could I answer their question from this data?" That's the mindset. You're not building a checklist app. You're building the foundation of an evidence system. Host: That reframing is useful. Before people start, what's the tricky part — the thing that trips students up in this exercise? Expert: The trap is over-modeling. Students see "milestones, requirements, statuses, evidence, priorities" and try to build a cathedral — deeply nested structures, lots of optional fields, clever inheritance. Resist that. The AI Act's enforcement timeline is genuinely simple: four dates, a handful of requirements per date, a small set of possible statuses. Keep your structures flat and obvious. Use plain text labels for status — "not started," "in progress," "complete" — not some elaborate enumeration. Store evidence as a simple link or reference string. And when you compute the overall compliance score, just do the obvious thing: count completed requirements, divide by total, multiply by a hundred. Don't weight them cleverly on the first pass. You can always add sophistication later. The second gotcha is dates — make sure you store the milestone dates in a way you can actually compare and sort, not just as display strings. That comes back to bite people when they try to ask "what's overdue?" Host: Great. So let's land this. What will the listener be able to do after this exercise, and what's coming next? Expert: After this, you'll be able to take any regulatory framework — not just the AI Act, but any structured set of obligations with deadlines — and turn it into a living, queryable tracker that answers real questions about where your organization stands. You'll be able to compute compliance scores, surface what's overdue, and attach evidence to every claim. This is the kind of building block your team can take directly into architecture discussions about how your governance platform should be shaped. Next, you'll extend this tracker with automated checks — instead of a human setting a status to "complete," you'll register little verification routines that run on a schedule and update the status for you. That turns your checklist from a static record into a live system. And the third exercise after that pulls it all together into an automated gap report with prioritized remediation steps. By the end of the three, you'll have a working compliance platform prototype you can show your governance and legal partners. Host: Perfect. Good luck with the build — thanks for listening, and we'll see you in the next one.