AI Act posture: operational — risk management (Article 9) and logging (Article 12) are live and producing audit-grade evidence.

Article 12 requires automated logs of high-risk AI system events. Signed dossier volume is the operational evidence that logging is actually happening — not just documented.

Next move — 128 signed dossiers/month is operational. Next move is breadth: add at least one regulated workflow (treasury movement, healthcare authorization, or AI-agent tool call) so the dossier mix proves governance, not just retries.

Article 9 mandates a continuous risk management process across the AI system lifecycle. Coverage of high-blast-radius actions is the auditable surface that proves risk identification reaches the actions a regulator cares about.

Next move — ~17% high-blast-radius coverage is on the path. The next layer is regulated workflows that buyers ask about by name (treasury, refunds above a threshold, AI agent tool calls). Add them to the evaluator.

Article 16/17 require a documented quality-management system mapped to the system's purpose. Verified policy packs are the encoded conformity layer that a conformity assessment can reference by hash, not by PDF.

Next move — Policy coverage is Strong. Next move is contributing one customized pack back so prospects see attribution as a marketing-acquisition surface.

Article 14 requires effective oversight by natural persons during the period the AI system is in use. Approval pings are the measurable human-in-the-loop surface that satisfies oversight in production — not just in onboarding.

Next move — 18 approval pings/month is the start of an override loop. Each ping you don't route is a 👍-thread audit gap. Route at least one more decision type (vendor onboarding, refund, or contract change) through the same surface.

Article 13 + 61 require providers to make information available to deployers and to monitor performance after launch. Public verify links, audit rooms, and signed proof are the three primitives that make this practical instead of paperwork.

Next move — Missing: private signing keys. Each one removes a category of question a reviewer can ask. The cheapest next move is enabling private signing keys — minutes of work, an immediate posture lift.