Generate compliance gap report with priorities — lab audio overview

Host: Welcome back. You're in GenAI Evaluation, Safety and Governance — a course about making sure the AI systems your team ships are trustworthy, tested, and legal to operate. This chapter is on the European Union AI Act, which is the new law in Europe that regulates how artificial intelligence can be built and deployed. The penalties are now active, and this skill — spotting where you're out of compliance and fixing the most urgent gaps first — is something every AI team is dealing with right now. Expert: Let me paint the scenario. Picture a mid-sized company, maybe two hundred engineers, that ships an AI-powered hiring assistant into the European market. Under the new law, a hiring tool is considered high-risk, meaning it has the strictest obligations — things like keeping detailed records, running bias tests, and letting humans override decisions. Now imagine the compliance team sends over a spreadsheet with eighty different requirements. Some you've met. Some you haven't. Some are half-done. The deadlines are staggered — a few are already live, others kick in next quarter, others next year. The fines for missing a deadline can go up to seven percent of global annual revenue. That's not a rounding error. That's material to the business. Without a system that tells you which gap to close first, your team will either panic and fix easy things while ignoring the expensive ones, or freeze and fix nothing. Engineering leaders everywhere are scrambling to build exactly this kind of triage tool. That's what you're building today. Host: Okay so this is the final exercise in this objective. In the previous one, you built an automated checker — a piece of software that runs verification tests against each legal requirement on a regular schedule and records whether you passed or failed. Now you're taking all those recorded results and turning them into something a human executive can actually act on. So — what are we building? Expert: You're building a report generator. Think of it as the layer that sits on top of the checker from the previous exercise. The checker produces raw data — a long list of requirements, each marked as fully compliant, partially compliant, or not compliant. Your new tool reads that list, filters down to just the problems, ranks them by urgency, and writes a clean, readable report for leadership. Here's the key idea, the conceptual shift. A list of failures is not the same as a plan. If you hand an executive eighty red checkmarks, nothing happens. But if you hand them three sentences — "these two items are already past their enforcement date and carry maximum fines, fix them this week; these five are due in sixty days, assign them now; these twelve are lower priority, schedule for next quarter" — now you have action. So the tool does three things in sequence. First, it filters out the things that are already fine. Second, it sorts the remaining gaps by how close the legal deadline is and how severe the risk category is. Third — and this is the interesting part — it uses Google's Gemini language model, which is a large AI system that can read structured data and write human-sounding text, to generate specific recommendations for how to fix each gap. Host: Got it. So you're using AI to help manage AI compliance — there's something poetic there. Before we wrap, what's the tricky part? What should people watch out for when they sit down to write this? Expert: The trap is prioritization logic. It sounds simple — sort by deadline, right? But real compliance has two dimensions that fight each other. One is time pressure: how soon is the deadline. The other is severity: is this a high-risk system with massive fines, or a lower-risk one with smaller penalties. A gap that's due in thirty days on a low-severity item might actually be less urgent than a gap due in ninety days on a high-severity item where the fine is ten times larger. So when you write the ranking logic, don't just sort by date. Combine both factors into a single priority score. The exercise will guide you, but keep that trade-off in your head. The other thing to watch: when you ask the language model to generate remediation advice, give it structured context — the requirement text, the current status, the deadline — not just a vague prompt. The quality of the recommendation depends entirely on how much specific detail you feed in. Host: That's a great reminder — garbage in, garbage out applies double when you're generating legal-adjacent advice. So to close — what will the listener be able to do after this? Expert: After this exercise, you'll be able to take raw compliance check data and turn it into a prioritized, AI-generated action plan that a non-technical executive can read and approve. You'll know how to combine deadline urgency with risk severity into a single ranking. And you'll know how to prompt a large language model with structured data to get useful, specific recommendations — not generic filler. For your team, this is the capstone piece. Combined with the timeline tool from exercise one and the automated checker from exercise two, you now have the complete compliance monitoring pipeline — a working implementation you can bring back to your team's architecture discussions when they ask how to handle the new regulation. This is the final exercise in the objective, so once you've finished, you've covered the full loop: know the rules, check against them, and report the gaps. Good luck, and thanks for listening.