Making AI Governance Part of Your Code, Not Just Paperwork
Abstract
AI governance often remains confined to policy documents, periodic reviews, and compliance checklists that may not be revisited after approval. AI systems, however, continue to change: models are retrained, datasets are replaced, prompts are revised, and system components are updated. Without continuous validation, the gap between approved governance requirements and the system’s current behavior may remain undetected until an audit, incident, or user complaint occurs.
This talk proposes an approach for closing that gap by translating governance requirements into automated and testable engineering controls. Under this approach, requirements related to privacy, fairness, security, transparency, data quality, and accountability would be validated alongside unit and system tests. As an illustrative example, if a customer-service AI must not disclose personal information, representative inputs could be used to test whether its responses comply with that requirement. A failed check would prevent release until the issue is corrected or an exception is formally reviewed and approved.
When a governance requirement changes, its associated tests would be updated, and only the affected parts of the system would be revalidated, using traceable links between each requirement and its tests. Engineers would receive clear and timely results, while compliance officers would gain traceable evidence of what was tested, when it was tested, and how failures or exceptions were addressed. The approach has not yet been evaluated in a production release; it is presented as a proposed design, and the talk outlines how it could be piloted and validated. By connecting policy requirements directly with software testing, this approach aims to transform AI governance from a one-time documentation exercise into a continuous and verifiable part of AI development. This talk draws on the author’s ongoing research on automated, code-based compliance for AI systems under emerging regulations such as the EU AI Act.
- Published in
- Proceedings of the Raptors Conference, Vol. 1 (2026)
- Conference
- Raptors Conference 2026, 21 October 2026, online
- Accepted
- 2026-10-12
- DOI
- https://doi.org/10.68495/rc.2026.C042
- Presentation
- Slides are not yet available for this paper.
- Licence
- © 2026Manish Gupta. Published under Creative Commons Attribution 4.0 International (CC BY 4.0).
- Publisher
- Hackathon Raptors, Community Interest Company 15557917, London, United Kingdom
- Permanent address
- https://proceedings.raptors.dev/gupta-making-ai-governance-part
Open access. Every entry in the Proceedings is free to read, with no charge to authors and no charge to readers. Slides are served from this site, so they stay available at the paper's permanent address.
Cite this paper
Manish Gupta (2026). Making AI Governance Part of Your Code, Not Just Paperwork. Proceedings of the Raptors Conference, Vol. 1 (2026). Hackathon Raptors, London. https://doi.org/10.68495/rc.2026.C042
@inproceedings{raptors2026-c042,
title = {{Making AI Governance Part of Your Code, Not Just Paperwork}},
author = {Gupta, Manish},
booktitle = {Proceedings of the Raptors Conference},
volume = {1},
year = {2026},
publisher = {Hackathon Raptors},
address = {London, United Kingdom},
doi = {10.68495/rc.2026.C042},
url = {https://doi.org/10.68495/rc.2026.C042},
abstract = {AI governance often remains confined to policy documents, periodic reviews, and compliance checklists that may not be revisited after approval. AI systems, however, continue to change: models are retrained, datasets are replaced, prompts are revised, and system components are updated. Without continuous validation, the gap between approved governance requirements and the system’s current behavior may remain undetected until an audit, incident, or user complaint occurs. This talk proposes an approach for closing that gap by translating governance requirements into automated and testable engineering controls. Under this approach, requirements related to privacy, fairness, security, transparency, data quality, and accountability would be validated alongside unit and system tests. As an illustrative example, if a customer-service AI must not disclose personal information, representative inputs could be used to test whether its responses comply with that requirement. A failed check would prevent release until the issue is corrected or an exception is formally reviewed and approved. When a governance requirement changes, its associated tests would be updated, and only the affected parts of the system would be revalidated, using traceable links between each requirement and its tests. Engineers would receive clear and timely results, while compliance officers would gain traceable evidence of what was tested, when it was tested, and how failures or exceptions were addressed. The approach has not yet been evaluated in a production release; it is presented as a proposed design, and the talk outlines how it could be piloted and validated. By connecting policy requirements directly with software testing, this approach aims to transform AI governance from a one-time documentation exercise into a continuous and verifiable part of AI development. This talk draws on the author’s ongoing research on automated, code-based compliance for AI systems under emerging regulations such as the EU AI Act.}
}
TY - CONF TI - Making AI Governance Part of Your Code, Not Just Paperwork AU - Gupta, Manish T2 - Proceedings of the Raptors Conference VL - 1 PY - 2026 DA - 2026/10/12 PB - Hackathon Raptors CY - London, United Kingdom DO - 10.68495/rc.2026.C042 UR - https://doi.org/10.68495/rc.2026.C042 AB - AI governance often remains confined to policy documents, periodic reviews, and compliance checklists that may not be revisited after approval. AI systems, however, continue to change: models are retrained, datasets are replaced, prompts are revised, and system components are updated. Without continuous validation, the gap between approved governance requirements and the system’s current behavior may remain undetected until an audit, incident, or user complaint occurs. This talk proposes an approach for closing that gap by translating governance requirements into automated and testable engineering controls. Under this approach, requirements related to privacy, fairness, security, transparency, data quality, and accountability would be validated alongside unit and system tests. As an illustrative example, if a customer-service AI must not disclose personal information, representative inputs could be used to test whether its responses comply with that requirement. A failed check would prevent release until the issue is corrected or an exception is formally reviewed and approved. When a governance requirement changes, its associated tests would be updated, and only the affected parts of the system would be revalidated, using traceable links between each requirement and its tests. Engineers would receive clear and timely results, while compliance officers would gain traceable evidence of what was tested, when it was tested, and how failures or exceptions were addressed. The approach has not yet been evaluated in a production release; it is presented as a proposed design, and the talk outlines how it could be piloted and validated. By connecting policy requirements directly with software testing, this approach aims to transform AI governance from a one-time documentation exercise into a continuous and verifiable part of AI development. This talk draws on the author’s ongoing research on automated, code-based compliance for AI systems under emerging regulations such as the EU AI Act. LA - en ER -