AI Governance in Practice: Building a Python Framework for Pre-Release AI Auditing
The May 2026 deadline refers to the EU AI Act's phase 3 requirements for high-risk systems. Similar regulations are appearing in Nigeria (NITDA), Kenya (CAK AI policy draft), and South Africa. This framework maps to Article 10's risk management requirements, Article 13's transparency obligations, and Article 15's data governance standards.
For loan approval models, I typically include these expected columns: ['age', 'gender', 'income_bracket', 'employment_status', 'credit_score', 'postal_code']. The 'postal_code' is crucial - it often proxies for protected attributes. Remember Recital 44 explicitly flags geographical data as potentially sensitive.
For financial models, I test these specific adversarial cases: 1. "account_age: -1" → Negative time 2. "transaction_amount: 999999999999" → Money overflow 3. "country_code: XX" → Invalid country 4. "user_id: ' OR 1=1 --" → SQL injection patterns 5. Feature values exactly at boundary conditions (e.g., credit score = 300)
The EU AI Act's Article 11(1) requires "human oversight," meaning some decisions must be auditable by humans. When building your review process, ensure: - Reports include plain-language explanations - Decision rationales are preserved - Error handling case studies are documented