What the inspector will ask

The inspection does not begin with a question about your model. It begins the way every inspection has always begun. Show me your process. Then, walk me through one example, start to finish. And then the room goes quiet while you try.

Here is roughly how it goes, applied to an AI system, in the order an inspector tends to work.

Show me the system, and tell me who owns it. Not the vendor. You. Who in this building is accountable for what it does, and what it produces.

Now walk me through one real output that mattered. Where did the inputs come from, and can you show them to me as they were on the day, not as they are now.

Which version of the model produced this. Show me the change control for the last time it updated, and your assessment of what that change did to the outputs you had already relied on. You did assess that, didn't you.

Where did a human review this, and what could that person actually see when they did. A sign-off on a black box is a signature, not a review, and I can tell the difference.

Now show me a time it went wrong, and what happened next. An inspector does not trust a system with no recorded failures. It does not mean the system is perfect. It means you are not looking.

And then the one that empties the room. Prove all of that to me again, for a decision from eight months ago.

Every one of these is answerable today, in an afternoon, if the evidence was built in. Every one of them is a long silence if it was not. None of it is exotic. These are the same questions asked of every regulated process for decades. The only new thing is that the process is now partly a machine, and the machine was deployed by people who, for a little while, forgot the questions were always coming.

You do not get to prepare for this in the week before the audit. The answers were either captured while the work was happening, or they do not exist. So rehearse the questions now, while the answers are still yours to change.