The process
This is how we build AI that is compliant from day one.
Most AI projects fail before the first line of code is written — in the requirements nobody wrote down, the architecture nobody reviewed, the obligations nobody mapped. Our process exists to make that impossible. Four phases, each with a gate, each producing artifacts you keep.
Why it matters
Standard AI development creates a compliance problem you discover too late.
Most AI vendors focus on one thing: building the application. Compliance, audit trails, data governance, and explainability are left for you to figure out after the fact.
That means expensive rework, delayed deployments, and real regulatory exposure under laws like the EU AI Act, GDPR, and DPDP.
We solve this by building governance into the application from the very beginning — not as a separate layer, but as part of the architecture itself.
The methodology
Three phases. One continuous cycle.
Each phase is designed to work together, not in isolation.
Govern
Before we write a single line of code, we understand your
regulatory environment. We identify which regulations apply,
define your risk appetite, map every obligation to a control,
and document accountability. By the end of this phase you know
exactly what you are building, why it is compliant, and who is
responsible for what.
Activities: regulatory mapping, risk classification, control
design, accountability framework, data inventory.
Build
We build the actual AI application — the models, the
integrations, the interfaces. Governance is part of every
decision. We embed audit logging, data lineage tracking,
explainability, and human override controls into the application
itself — not as an afterthought.
Activities: model development, system integration, audit trail
implementation, data lineage tracking, explainability layer,
human oversight controls, compliance documentation.
Run
Deploying the application is not the end. Regulations change.
Models drift. We stay with you after deployment — monitoring,
updating governance documentation, preparing for audits, and
evolving controls as your regulatory environment changes.
Activities: ongoing monitoring, audit preparation, model
performance tracking, regulatory update management, evidence
maintenance.
The delivery timeline
What happens before development starts?
Every build runs through the same four-phase sequence — sequence before code, not code before sequence. That order is what keeps a build defensible in front of a regulator later.
-
01
Classify
Requirements captured feature by feature. A written specification and wireframes you approve before development starts. Architecture reviewed by a named technical authority. And your regulatory obligations — DPDP, GDPR, AI Act classification where it applies — mapped now, because architecture decisions depend on them. You see the system on paper before you pay for it in code.
-
02
Design
Design the architecture around every regulatory obligation mapped to a technical control.
-
03
Build & Document
Develop the application with audit trails, data lineage, explainability, and human oversight built in — generating compliance documentation as the system is built, not after.
-
04
Close & Certify
Hand over a working system plus audit-ready documentation, and move into certification if that is part of your engagement.
What you receive at handover
- A compliance summary an auditor or regulator can review
- A risk classification for the system you built
- Audit-ready documentation — data mapping, control evidence, and decision logs generated during the build
In practice
IFRS Revenue Recognition Platform — governance-first AI for finance.
The challenge: A corporate finance department needed an AI system to help them comply with IFRS 15 — the international standard for revenue recognition. They were processing hundreds of contracts, invoices, and purchase orders manually. The process was slow, inconsistent, and difficult to audit.
What we built: A custom AI application that processes financial documents and runs them through the IFRS 15 five-step revenue recognition process. The system identifies performance obligations, calculates revenue realization, and generates a structured compliance report. Additional modules include a lease checker aligned with IFRS 16 and a third-party contract classifier.
How governance was built in: Every document processed is logged with a full audit trail — input document, processing steps, model version, and output report. Evidence is generated automatically so the finance team can demonstrate compliance to auditors without assembling documentation manually. Data handling follows GDPR principles with strict access controls, retention policies, and deletion workflows.
Status: Currently in active development with a corporate finance client.
What we build in
What a governance-first AI application includes that a standard one does not.
Audit trail
Every AI decision is logged with a timestamp, input data, model version, and output. Nothing is a black box.
Data lineage
Every piece of data is traceable from source to output. So when a regulator asks where your data came from, you have an answer.
Explainability layer
The system explains why it produced a particular output in plain language. Essential for high-risk AI under the EU AI Act.
Human override controls
Your team can review, challenge, and override any AI decision. The human always stays in control.
Model versioning
Every version of your AI model is recorded. You can see exactly which version was running at any point in time.
Data handling documentation
How personal data is collected, processed, stored, and deleted is documented and auditable. GDPR and DPDP compliant by design.
Consent and access controls
Who can access the system, what they can do, and how consent is managed is built into the application architecture.
Evidence workflows
Compliance evidence is generated automatically as the system runs — not assembled manually before an audit.
Ready to talk about your project?
Tell us what you are building and we will tell you how we would approach it — from governance design through to deployment. The scoping conversation takes 30 minutes and costs nothing.
Book a Scoping Call