ONE WORLD AI Discuss a pilot

Rules, execution
and evidence.

OWAI COMPLIANCE

Make regulatory work
operational.

For regulated organisations running AI agents, policy must become a condition at the point of action. With OWAI OS, your compliance team owns the rules as versioned policy, changes them without changing application code and receives evidence controllers can verify — making assessments faster to prepare and easier to evidence.

OWAI OS helps you prepare for assessment and certification. Compliance depends on the complete system, its purpose, the organisation’s role and its operation; OWAI OS does not certify systems or establish compliance by itself.

THE COMPLIANCE LAYER

From requirement
to reviewable action.

AI governance requirements often describe what a firm must establish: risk controls, accountability, oversight, traceability and a defensible record of operation. The operational question is more specific: what is allowed to happen in this workflow, who may authorise it and what evidence should remain?

OWAI OS is designed for that execution-level question. It separates a model’s proposal from the conditions under which a connected system may act.

CONTROL MODEL

Control the path.
Document the decision.

Each element below is assessed against the defined workflow and deployment, rather than claimed across an entire organisation or every possible AI use case.

01

SCOPE & RISK CONTEXT

Start with the decision, the people and the consequence.

A useful compliance assessment begins with the defined AI-enabled workflow: its purpose, the action it may influence, the people affected, the connected systems and the organisation’s role. That scope provides the context for a risk and governance assessment.

OWAI OS does not determine whether a system is legally high-risk or decide which legal requirements apply. Those determinations remain with the organisation and its legal, risk and compliance functions.

02

CONTROL MAPPING

Turn selected requirements into operational conditions.

For a defined workflow, selected requirements can be translated into versioned policy, authority checks, review conditions and controlled outcomes. The aim is to make the conditions for action explicit within the paths being integrated.

A control mapping is only as complete as its agreed scope. It does not replace legal interpretation, wider governance arrangements or controls outside the integrated path.

03

TRACEABILITY & EVIDENCE

Make the review path inspectable.

OWAI OS can associate a runtime decision with the relevant policy version, authority context, review requirement and available evidence of execution. This supports later review of what the control layer evaluated and decided.

A decision record is not, by itself, evidence that the input was correct, an outcome was lawful or an external action occurred. Those claims require their own evidence and controls.

04

DEPLOYMENT QUALIFICATION

Assess the system that will actually operate.

The deployment assessment considers model services, data boundaries, identity, retention, access, monitoring, connected executors and fallback paths. A pilot provides a practical way to verify selected controls against a real operating environment.

OWAI OS is in pre-production. Security, resilience, performance and regulatory suitability must be qualified for each agreed deployment and use case.

REGULATORY CONTEXT

Designed for the
questions regulated teams face.

OWAI does not provide legal advice. The frameworks below are examples of the context in which a customer may choose to scope a pilot and assess operational controls.

UNITED KINGDOM / FINANCIAL SERVICES

FCA expectations and Consumer Duty context

The FCA promotes safe and responsible AI adoption. Firms remain accountable for how they use AI under the rules that apply to them, including the governance, monitoring and consumer-outcome considerations relevant to their business.

Read the FCA’s AI guidance Our note: FCA and AI agents

EUROPEAN UNION / AI ACT

Risk-based obligations for AI systems

The EU AI Act applies a risk-based approach. Where relevant, high-risk obligations can include risk management, logging and traceability, documentation, human oversight, robustness, cybersecurity and accuracy. Applicability and duties depend on the specific system and role.

Read the European Commission overview Our note: EU AI Act and AI agents

CONTROLLED COMPLIANCE PILOT

Test a boundary
before you scale it.

A controlled pilot is a practical way to assess whether selected governance requirements can be expressed and evidenced in a real workflow.

  • Name the AI-enabled action and the business consequence.
  • Identify the relevant policy, authority and review conditions.
  • Map the connected executor, data boundary and evidence requirements.
  • Test the permitted path, required stop and escalation behaviour.
Discuss a compliance scope
Explore assurance, evidence integrity and deployment scope