AIR: an initial assessment of 2,000+ AI systems in about ten minutes

For a leading French public investment bank, I led the design of AIR. The internal tool turns legal, privacy, and security requirements into shared criteria, then produces an initial assessment for more than 2,000 AI systems in about ten minutes. The relevant teams approve every final decision.

RoleShapers engagement: product and program leadership, including how the service should operate

OutcomeInitial pass across 2,000+ AI systems in about 10 minutes

Human decisionNo classification is automatically final; human validation is required

In useExports serve as the reference for EU AI Act registers and control tools; the API reruns the assessment on demand

Anonymized screenshot of AIR and its versioned criteria — Anonymized real screenshot: versioned criteria, explicit changes, and controlled publication.

Manual review could not keep up

AI use was growing across several functions at once. With more than 2,000 systems to assess, a file-by-file review would quickly have become a bottleneck.

Teams needed room to experiment while applying the same compliance, security and traceability requirements. The answer had to be reusable rather than rebuilt for every use case.

I made the framework usable through a service

I brought internal policy, legal requirements, privacy, and security into a versioned knowledge base. AIR therefore keeps a record of the criteria applied and how they change.

Deterministic rules handle repeatable cases. The model is used only when the context requires interpretation.

AIR feeds the tools already in place

Its exports serve as the reference for the bank’s central access point to AI services, the AI Gateway, and for its governance platform. The API can rerun the assessment on demand when teams need it.

I also defined the target architecture for connecting AIR to other internal tools, so teams can reuse the same logic instead of rebuilding it in every product.

Five functions tested the framework against their constraints

I designed the core model and produced the first complete versions of the framework, matrices, and reference documents. These gave the teams concrete material to review, correct, and use in decisions.

Digital, IT, Compliance, Security, and Legal tested the choices against their own constraints. I kept the program coherent across those functions and drove unresolved trade-offs toward a common basis.

Initial pass

≈ 10 min

across 2,000+ AI systems. Exports then serve as the reference for registers and control tools.

What I was responsible for

Turning internal policy and legal requirements into criteria a service can apply.
Leading the product, program, technical choices, and service operations together.
Aligning Digital, IT, Compliance, Security, and Legal around shared criteria.
Defining how reference exports and the on-demand API support existing registers and control tools.

Work together

What is holding your product or program back?

Email me