Docs

Appearance

Compliance Lead Path ​

Drive audit-ready governance work for an AI system by running a clear gap analysis, assigning ownership, and moving Controls to evidence-backed execution.

Outcome ​

You leave this path with:

  • a scoped AI System with the right frameworks attached
  • a prioritized “what’s missing” view with clear owners
  • Evidence collection in motion for the highest-impact Controls
  • an internal review and export-ready audit trail

Time to first value: 60–90 minutes
Prerequisites: an AI System exists and you have an AI System role (Owner, Editor, or Viewer)

Use Scout if it’s available

Scout can accelerate gap discovery and drafting, especially when you ground questions with Controls, Requirements, Evidence, or risks.

Path at a glance ​

Step 1: Confirm scope and frameworks ​

Goal: make sure the AI System is the right unit of governance and is scoped to the frameworks you care about.

Where in Modulos

  • AI System → Settings → General Settings for the AI System definition and lifecycle stage
  • AI System → Settings → Frameworks to confirm frameworks and versions

Do this

  • Confirm the AI system description is accurate and specific enough for governance work.
  • Confirm the AI System lifecycle stage reflects reality (so work is triaged appropriately).
  • Confirm required frameworks are attached and up to date for your use case.

You’re done when

  • the AI System clearly describes what the system does, who it affects, and the deployment context
  • the right frameworks are attached to the AI System

Step 2: Run a gap pass and assign ownership ​

Goal: produce an actionable backlog with clear accountability.

Where in Modulos

  • AI System → Requirements to review Requirement readiness
  • AI System → Controls to review and assign Control execution
  • AI System → Settings → User Access to confirm AI System roles are assigned

Do this

  • Start from Requirements and identify the largest gaps (most “not fulfilled”).
  • For each priority Requirement, review mapped Controls and assign an Owner.
  • Mark items out of scope only when there is a clear justification and audit trail.

You’re done when

  • the top gaps have named owners
  • there’s a clear plan to move the highest-impact Controls to execution

Step 3: Drive evidence-backed execution ​

Goal: move from “we intend to” to “we can show it”.

Where in Modulos

  • AI System → Controls → select a control → Control tab to attach Evidence and update execution status
  • AI System → Controls → select a control → Assessment tab to run a structured readiness assessment when available

Do this

  • For each priority Control, attach the strongest Evidence you already have.
  • Collect missing artifacts and attach them to the relevant Controls.
  • Use structured drafts (for example assessments) to make reviews faster and more consistent.

You’re done when

  • priority Controls have Evidence attached that actually demonstrates execution
  • Control status reflects reality and is ready for review where appropriate

Step 4: Prepare internal review and exports ​

Goal: make the work auditable and easy to validate.

Where in Modulos

  • AI System → Requirements and AI System → Controls for readiness review
  • AI System → Dashboard → Export for the AI System PDF, plus per-file Evidence download from the relevant Control
  • AI System objects → Comments and Logs for traceability of key actions

Do this

  • Ensure Control status changes carry meaningful comments and Requirements are reviewed and marked Fulfilled by their owners.
  • Review each object's Comments and Logs for key decisions and status changes.
  • Export the AI System PDF and download the Evidence files needed for internal audit readiness.

You’re done when

  • internal reviewers and auditors can trace Requirements → Controls → Evidence without guesswork
  • you can export the AI System PDF and gather the Evidence files that match the current status snapshot

Next handoff ​

AI Product Owner

Ensure the AI system description and lifecycle context stays current

Risk Manager

Quantify top risks in monetary terms and review exposure against budgets

Engineer & Integrations

Connect systems so Scout and governance work can reference real artifacts