Compliance by Design Is Cheap. Compliance by Emergency Is Not.
Building governance into the AI lifecycle from day one costs a fraction of retrofitting it — the difference between a planned workstream and a hostage situation.
Every engineering leader understands technical debt. Compliance debt behaves identically, except that the interest rate is set by someone else and the repayment date is not yours to choose. It is called by a customer's procurement team, a certification body, or a regulator — and it is always due immediately.
What retrofitting actually costs
The gap is not primarily about documentation effort. It is about what you discover when you look properly at a system built without governance in mind:
- Data provenance you cannot reconstruct. Article 10 and Annex A.7 require training data to be relevant, representative and governed. If never tracked, the options are expensive forensics — often inconclusive — or retraining.
- Human oversight never designed in. Retrofitting a meaningful override capability into a system architected for straight-through processing is a workflow redesign touching operations, staffing and SLAs.
- Logging that does not exist. Article 12 requires automatic event logging. Adding it later means a release cycle you had not planned, on a system that is in production and revenue-bearing.
- Decisions nobody recorded. Why was this threshold chosen? Who accepted this false-positive rate? If the answer is institutional memory that has since left, you are reconstructing rationale rather than producing evidence.
The design-time version of the same work
Contrast with requirements addressed as the system is built. Data provenance is a field in the pipeline. Human oversight is a design constraint in the first architecture review. Logging is a standard library. The marginal cost of each is close to zero, because you are not adding a compliance layer — you are making choices you were going to make anyway, in a way that leaves a record.