'/%3e%3cpath%20d='M4%206L17%206L23%2016L17%2022L4%206Z'%20fill='url(%23g)'/%3e%3cpath%20d='M4%206L17%206L20.2%2011.3L15.6%209.9L4%206Z'%20fill='%23fff'%20opacity='0.28'/%3e%3cpath%20d='M44%206H31L19%2024V44H28V26L44%206Z'%20fill='url(%23b)'/%3e%3cpath%20d='M44%206H31L19%2024V44H28V26L44%206Z'%20fill='url(%23g)'/%3e%3cpath%20d='M44%206H31L20.4%2021.8L23.2%2022.9L34.2%208.6H41.6L44%206Z'%20fill='%23fff'%20opacity='0.26'/%3e%3c/svg%3e)
Regulated deployments need answers to: what data went to which provider, which model version produced this decision, who approved it, and how a user exercises deletion.
Practical controls:
- Data map — per feature, list the data classes sent, the provider, region, and retention. - Decision records — for consequential outputs store input hash, model id, prompt version, retrieved ids, output, and reviewer. - Provider posture — training opt-out, zero/short retention, regional processing, signed DPAs. - Human oversight — a documented reviewer for consequential decisions, matching EU AI Act transparency and oversight expectations for higher-risk uses. - Right to erasure — delete source rows, derived memories, embeddings, *and* trace payloads. Missing the last two is the usual audit finding.
sql
create table ai_decisions (
id uuid primary key default gen_random_uuid(),
subject_id uuid not null,
feature text not null,
model text not null,
prompt_version text not null,
input_hash text not null,
retrieved_ids text[] not null default '{}',
output jsonb not null,
reviewed_by uuid,
created_at timestamptz not null default now()
);Exercise: implement an erasure job that removes a user's rows, memories, embeddings, and trace payloads, then prove completeness with a query per store.