REGULATORY READINESS · 8 MIN READ

AI Regulatory Readiness Is Becoming an Evidence Problem.

Policies alone may not demonstrate effective AI governance. Organisations increasingly need inventories, decisions, controls, monitoring records and assurance evidence that show how governance works in practice.

INTAI Research · Published 26 May 2026

Read the Update

The Policy Was Never the Hard Part

Across every regulatory framework covered in this series, the EU AI Act, UK sector regulation, GDPR’s intersection with AI, ISO 42001 and NIST AI RMF, a common thread has emerged clearly enough that it deserves to be stated as its own point: none of them are ultimately satisfied by a well-written policy document. All of them are, in practice, asking for evidence.

That distinction matters because it is precisely where a large share of organisations currently fall short. Regulators expect documented controls, technical safeguards and operational evidence of compliance, not aspirational ethics statements. When an auditor asks how an organisation governs AI access to sensitive data, the answer they are looking for is not a policy describing how access should be controlled. It is evidence that access controls were technically enforced, that every access event was attributed to a specific, accountable individual, and that the policy the documentation describes is the practice that actually occurred.

What “Evidence” Actually Means Across These Frameworks

The specific evidentiary demands differ by framework, but the underlying shape is remarkably consistent. Under the EU AI Act, it is technical documentation, risk management records and logging capable of showing a high-risk system’s behaviour after the fact. Under GDPR, it is a documented DPIA that draws on the AI system’s own technical disclosures. Under ISO 42001, it is the audit trail a certification body reviews directly. Under NIST AI RMF, it is the risk assessment and monitoring records a procurement counterparty or insurer increasingly asks to see.

In every case, the organisations that pass scrutiny are maintaining a centralised, current inventory of the AI systems they use, tracking each system’s version history and material changes, documenting the risk assessment behind each deployment decision, and generating monitoring records as a routine by-product of how the system operates, not reconstructing a compliance narrative retrospectively once a regulator, auditor or customer actually asks the question.

Central Insight

A genuinely useful test for any organisation's current AI governance maturity: if a regulator asked tomorrow to see the evidence behind a specific AI system's risk classification, human oversight arrangement and monitoring record, could that evidence be produced within a day, already assembled, or would it need to be built from scratch, under time pressure, after the request arrived? The gap between those two answers is the actual measure of regulatory readiness, and it has very little to do with how well-written the underlying policy document is.

Building Evidence as a By-Product, Not a Project

The organisations managing this well share a specific design principle: evidence generation is built into how the AI system operates day to day, rather than treated as a separate compliance project run periodically alongside it.

That means logging, version tracking and decision documentation happening automatically as part of the system’s normal operation, rather than requiring a dedicated effort to reconstruct after the fact. It means a single, current AI system inventory that every relevant framework, the AI Act, GDPR, ISO 42001, NIST AI RMF, can draw evidence from, rather than four separate documentation exercises maintained in parallel. And it means treating regulatory readiness as a continuous operating discipline across an evolving, fragmented global landscape, rather than a project completed once and then filed away, given how much of what this series has covered, the EU's May 2026 deferral, the UK's evolving regulator plans, the ongoing GDPR-AI Act joint guidance, is still actively moving.