They are cheap to ask
A supervisory authority opening an inquiry does not begin with a technical audit. It begins with questions whose answers are documents.
Before the letter
Five questions you should be able to answer today.
Not one of them is answered by knowing the law. All of them are answered by records that were made before anybody asked — which is why they are worth checking now rather than when somebody is waiting.
01
Which AI systems are actually in production?
Including capabilities a vendor added to software you already licensed, and tools a department adopted without central review. Most organisations find the real list is longer than the one they keep — and the gap is not a filing problem, it is the set of deployments nobody has assessed.
02
What decision does each one make or influence?
Regulatory weight concentrates on consequential decisions — credit, housing, employment, healthcare, education, insurance, access to essential services. A scheduling assistant and an underwriting model are not the same object under the law, and describing both as an AI tool is how the difference gets lost.
03
Whose residents does each system touch?
Obligations attach by where the person is, not where you are. One tool used across twelve states is twelve separate applicability questions, and answering them as one is the most common way a register becomes indefensible.
04
Where is the assessment — or the documented decision that none was required?
Both answers are defensible. Neither is defensible undocumented. An empty file does not read as not required. It reads as not considered, and the difference is the whole of your position.
05
Who owns each obligation, by name — and when did the review begin?
An owner is a person, not a department. And the date is the one answer on this page that cannot be produced later: a record created after an inquiry arrives is evidence of reaction, not of process.
If assembling these answers would take more than a few days, that is itself the finding. An inquiry rarely allows more time than that.
Why these five
They are the ones a regulator can ask without knowing your business.
Every one of them is answerable from records you either have or do not have. None of them requires the questioner to understand your architecture, your sector, or your strategy — which is precisely why they are the ones that get asked.
They are expensive to answer late
Each one is a week of work under pressure if the record does not exist, and twenty minutes if it does.
They are the same five everywhere
The statutes differ enormously. What a regulator wants to see first, across jurisdictions, converges on this list.
Answer the first three for one tool
One deployment. Fifteen minutes.
A determination answers questions two and three properly, and gives you the dated record that answers question four. The other two are yours.