Common mistakes

1 min read · Chapter 9 of 10

What usually goes wrong

Symptom	Likely cause	First thing to check
Audit finds AI that isn't in the inventory	Intake forms only; vendor features and personal accounts missed	Procurement records and security discovery against the register
People use unapproved tools after a rejection or a long wait	Intake too slow, or the low tier too heavy	Time from request to decision, by tier
Validation reports say little about the foundation model	Bank methods applied to a model you can't inspect	Behavior tests on your own data, and what they cover
Answers changed with no release on your side	The vendor updated or retired the model	Pinned versions; vendor change notices; re-test records
Conditional approvals never close	No owner or date for the conditions	The exception register and its ages
Human review approves everything	Reviewers without time, training or authority	Override rates by reviewer
A regulator or court asks for a decision you can't reproduce	Logs and versions not kept after retirement	Retention by rule; the archive
A customer rejects your evidence	A certificate with narrow scope or from an unaccredited body	The certificate's scope and issuer
An AI loss isn't covered	Generative-AI exclusions in the policy	Exclusion wording; whether dedicated AI cover is needed