ISO 42001 NIST AI RMF GDPR EU AI Act SOC 2
DISCONNECTED
Week 14/20  |  Jan 27 – Feb 9, 2026
Executive Steering Committee  |  ON TRACK
1Executive Summary & Project Health LIVE
70%
Completion
+8 pp WoW
Wk 14/20
Schedule
On Plan
$1.26M
Spend
2.3% under
Green
RAG Status
Healthy
82%
Governance
+5 pp WoW
  • Phase 2 (Core Retrieval) complete; 12M docs indexed — 20% ahead of milestone.
  • Phase 3 (Generation Pipeline) 45% complete — prompt-chaining passed integration tests; Mar 6 delivery on track.
  • Budget $29K favorable ($1.26M actual vs. $1.29M plan) from cloud-compute optimization.
  • No critical blockers. 1 medium-risk (vendor API rate-limit) under active mitigation.
2Performance & Adoption — Live Telemetry REAL-TIME
99.92%
Uptime
vs 99.8% SLA
47.2K
Weekly Queries
+18% WoW
91.4%
Accuracy (F1)
+1.2 pp
Real-Time Latency (P50 / P95 / P99) — ms
Query Throughput — QPS
Department Adoption
Satisfaction (CSAT)
86%
4.3 / 5.0
+0.2 from prior week
  • Top praise: answer speed & citation accuracy.
  • Top request: multi-language (Phase 4).
3Quality & Financial Performance
$0.027
Cost/Query
-12% vs plan
2.4x
Projected ROI
vs 2.0x target
18%
Productivity
hrs saved/wk
97.8%
QA Pass Rate
target 95%
-$29K
Budget Var.
Favorable
  • 412 test cases — 97.8% pass; 9 defects, 7 resolved, 2 deferred.
  • Cost/query down after quantization; target $0.024 steady-state.
  • Support saves 6.2 hrs/wk; Engineering 4.8 hrs/wk on doc lookups.
3bCompliance & Governance — Automated Scoring AGENT-DRIVEN
ISO 42001
78%
+6 pp
NIST AI RMF
81%
+4 pp
GDPR Art 22/35
72%
DPIA in prog
EU AI Act
Limited
Confirmed
ISO 42001 — Annex A Controls
ControlDescriptionStatus
NIST AI RMF — Function Maturity
  • DPIA 65% complete; data mapping done; legitimate interest under legal review — target Feb 18.
  • Model Card v2 drafted per NIST MAP 1.5 / ISO A.7.3.
  • EU AI Act "Limited Risk" confirmed — transparency obligations only.
3cGovernance RACI Matrix
Activity
Data Sci
Compliance
Audit
Business
Engineering
AI Risk Assessment (ISO A.6.2)
C
R
A
I
C
DPIA Execution (GDPR Art. 35)
C
R
I
A
C
Model Training & Validation
R
C
I
I
A
Bias Monitoring (NIST MEASURE)
R
A
C
I
C
Production Deployment
C
C
C
A
R
Incident Response (NIST MANAGE)
C
A
I
I
R
Continuous Audit & Improvement
C
C
R
A
I
R=Responsible  A=Accountable  C=Consulted  I=Informed
4Departmental Workstreams
WorkstreamOwnerCompletionStatusUtil.Trend
  • UI/UX 95% utilization — 120 hrs unplanned; request 1 contract dev (Decision #1).
  • Training cohort #1 (Engineering) launches Feb 16.
5Risks & Issues 3 ACTIVE
Requires Executive Attention
  • R-1 · Vendor API Rate-Limit (Med | NIST MG 4.1). Throttle Mar 1 — P95 +40%. Mitigation: Enterprise tier ($8K/mo); fallback tested. Decision Feb 13
  • R-2 · UI/UX Capacity (Med). 95% util; 120 hrs unplanned. Mitigation: Contract dev $18K. Approval needed
IDCategoryFrameworkSeverityProbMitigationTrend
6Decisions Required ACTION
Decision 1 — Contract Developer
  • Context: UI/UX at capacity; unplanned a11y work.
  • Option A (Rec.): 1 dev, 4 wks ($18K). On schedule.
  • Option B: Defer features 2 wks. $0 cost.
  • Deadline: Feb 10  Owner: VP Eng
Decision 2 — LLM Tier Upgrade
  • Context: New rate limits Mar 1; latency at risk.
  • Option A (Rec.): Enterprise (+$8K/mo). 3x ceiling.
  • Option B: Multi-provider ($3K/mo); ops complexity.
  • Deadline: Feb 13  Owner: CTO
7Next Week — Priorities & Deliverables
DeliverableDueOwnerDepsPri
Prompt-chaining integration testsFeb 10S. RiveraQA env stableP0
SOC 2 evidence packageFeb 12J. OkaforInfra log exportsP0
DPIA legitimate interestFeb 14DPO OfficeLegal sign-offP1
Engineering training cohort #1Feb 16K. DuvalTraining env readyP1
WCAG 2.1 AA remediationFeb 14L. TanakaDecision #1P1
8External Dependencies & Blockers
Vendors
  • LLM: Enterprise contract in legal; ETA Feb 11. Pending
  • AWS: GPU RI confirmed Q3. Clear
Approvals
  • InfoSec: Pen test Feb 17-19. Scheduled
  • DPO: DPIA approval pending. In Review
Regulatory
  • EU AI Act: Monitoring; no scope changes. Clear
  • GDPR DPA: No inquiries. Clear
8bArchitecture — Data Flow & Security Boundaries
Users
Browser/API
GDPR Boundary (EU-West-1)
API Gateway
Auth · PII Redact
Internal VPC · AES-256
RAG Engine
Orchestrator
Vector DB
12M docs
Agent Mesh
6 AI Agents
Audit Log
ISO A.8.4
External Vendor
LLM API
No PII transit
GDPR VPC Agent Mesh External Audit Encrypted
8cGovernance Artifacts
Required Documents
📄DPIA (Art. 35)65%
📄Model Card v2Draft
📄System Guardrails DocApproved
📄ISO 42001 SoAApproved
📄NIST PlaybookReview
Audit & Compliance
📋SOC 2 Evidence80%
📋Pen Test ReportFeb 17
📋Fairness AuditFeb 20
📋Art. 30 RecordsDone
📋Incident PlaybookDone
9Executive Action Items
ActionOwnerDueStatusTrendFollow-up
10AI Governance Directive Evaluator AGENT-POWERED
Senior AI Governance Architect & Compliance Officer — Evaluates whether a directive constitutes a viable, actionable business use case. Scored against 3 criteria: Goal Clarity, Operational Scope, Domain Context. Score ≥ 2 → PATH A Full Governance Report  |  Score < 2 → PATH B JSON Diagnostic. Grounded in ISO 42001 NIST AI RMF GDPR EU AI Act.
Confidential — Executive Steering Committee  ·  ISO 42001 Ref: RAG-GOV-RPT-014  ·  Agentic AI Engine v2.0  ·  Next Report: Feb 13, 2026  ·  rag-governance@company.com