Governance & Compliance

Five mechanisms provide end-to-end governance over AI-generated work in regulated environments.

1. DPIA: documents what data is processed by AI models — required under GDPR / UK GDPR for high-risk AI processing.
2. Policies: configurable rules governing agent behaviour, code quality and disclosure requirements.
3. Definition of Ready and Done: every work package moves only when its checklist gate has passed on two sides — the reviewer agents and a person. Verify collates what those gates found across the studio.
4. Releases on two keys: a release is approved by the server’s readiness check and a named person, and ships only once every pull request on it has merged.
5. Audit Explorer: an append-only log of every governance-significant action, with named actors and timestamps.

DPIA requirements

Complete your DPIA in DPIA & Model Risk: data categories, model risk level, necessity and proportionality, retention and incident response. A release that contains AI-generated changes — any package built by a coding agent — can be approved only when it names a DPIA whose status is approved.

Release sign-off

An owner or studio admin approves a release on the Release plan. Approving re-checks every package on the server and records who approved it, when, and why. Once approved, what the release contains is frozen, and a pull request that changes afterwards has to be approved again before it ships; a released release can be rolled back, with the reason recorded, but not rewritten. Where practical, the approver should be a different person from the package reviewers.