TODO.LAWAI SENTINEL

How it fits together

Three columns, in order: what you tell the product, what it works out for you, and what you can hand to someone else. Nothing in the middle column is typed by a person.

YOU SAYIT DERIVESYOU HAND OVERWhere you operateYour AI systemsWhat each can doWho receives dataAnswers to questionsWhich regimes applyRisk tier and dutiesThreat scenariosControls and testsObligations with datesImpact assessmentsNotices and protocolsThreat model documentCompliance registerProgram pack

Anything the product derives is marked as derived until a person confirms it, and the proportion confirmed is printed on every export.

Which record answers which question

What AI do we have, and who owns it?AI registry
Which of it is high-risk, and under which rules?Risk classification
Which regimes apply to this system, and what do they demand?Cross-border regimes
What could go wrong in the thing we are building?Threat model
Does the control actually work?Threat model tests
Can we show an obligation is met?Compliance register
Who decided this, and when?Oversight and the audit trail
What do we hand a customer, an auditor or a regulator?The program pack

Three ways in

We use AI tools

Start from the vendor catalogue or an industry template. The wizard registers the systems, classifies them and drafts the policies.

We are building AI

Start from the builder path. Tick what your product can see and do, and get the threat model with its controls and tests.

We advise others

Set up as a consultant: each client is an organisation, with its own register, documents and evidence.

The rules that hold it together

  • ·An unanswered question emits nothing. The product never infers scope from silence, and a gap is shown as a gap.
  • ·Anything derived automatically is marked as such until a person confirms it, and the confirmed proportion appears on every export.
  • ·Only a control with a current passing test becomes evidence. An untested guardrail evidences nothing.
  • ·Running the wizard again tops up what is missing rather than creating a second copy: systems, policies, vendors and threat models are all deduplicated by name.
  • ·Every export states when it was generated, from which version, and under which rule packs; the pack carries a digest for each file.
  • ·Legal sign-off is pending on the regulatory content, and every document says so rather than implying otherwise.