FairByDesign · Free field manual
Operational AI Readiness
A Practitioner Guide to Governing AI That Is Already Live
By Viktoria Bakos · Published by FairByDesign · Standard edition, free to read and download
AI is already operational. The question is whether you can see what it is doing, control it, explain it, and prove the controls worked.
No account, no email wall, no catch. The whole Standard edition: 12 chapters and all five appendices.
The problem this book is for
Somewhere in your organization, an AI system is already shaping a decision that matters: which applications get read first, which payment gets flagged, which customer dispute gets a polite no, which security alert gets ignored. The tools work and the policy exists. But ask five simple questions and the room goes quiet. What is the system allowed to do? What changed last week? Who reviews the outputs that matter? What gets recorded? Who can stop it?
This book is about that silence. It does not argue about whether AI is good or bad, and it is not a principles document. It is an operating discipline for making a live AI workflow legible, bounded, reviewable and explainable, under ordinary use and under pressure. Its standard is blunt: a workflow that cannot be reconstructed under scrutiny is not operationally ready. It is just active.
It draws on the NIST AI Risk Management Framework and its Generative AI Profile, the EU AI Act’s expectations for human oversight and risk management, and the OWASP Top 10 for LLM Applications. It turns that language into workflow-level controls a team can build in a month.
The sharper question: do your controls actually work?
Most AI frameworks tell you which controls to have: an inventory, an owner, human oversight, logging. They are useful, and this book builds on them. But having a control and being able to show that it operated are different things. Human oversight can exist on an org chart and never touch a decision. A log can exist and still be unable to tell you which prompt, which sources and which reviewer produced a particular outcome.
So the book asks for evidence that holds up under pressure. It wants a control to exist, and it wants the record to show the control was used. Reconstruction means you can rebuild what happened from records, not from memory or screenshots. Assurance means someone outside the team could check it. And for failure, you decide in advance what happens when the control does not hold. That is the question FairByDesign’s reporting and Evidence Lab keep asking in public. This book is the practitioner’s version of it.
What you will be able to do
Inventory your consequential AI workflows and classify their real decision influence honestly. Build approval gates where impact justifies friction. Create an evidence spine that lets you reconstruct an AI-assisted decision after the fact. Design human oversight that survives busy reviewers and real deadlines. Run a 30-day readiness sprint that produces artifacts, not aspirations. Question vendors about logging, data handling, incident response and validation.
Twelve chapters
1 What Operational AI Readiness Is · 2 Where Risk Appears in Live AI Systems · 3 Classifying Decision-Influencing AI Without Lying to Yourself · 4 The Minimum Viable Control Stack · 5 Human Oversight That Actually Works · 6 Runtime Visibility and the Evidence Spine · 7 Security Controls for LLM Apps and Agent Workflows · 8 Change Management for Models, Prompts, Tools, and Retrieval · 9 Approval Gates for High-Impact Actions · 10 The 30-Day Readiness Sprint · 11 What Auditors, Regulators, and Internal Reviewers Will Actually Look For · 12 Building an Engineering-Owned Control Culture
Five working appendices
A: sample policy rules in YAML, and why each exists. B: an evidence logging schema with field logic. C: a human-in-the-loop workflow specification. D: a vendor due-diligence question bank. E: a minimal readiness test suite. These are the starter kit, not decoration.
Read it, keep it, share it
The Standard edition is free. Read it in your browser, or download the PDF for your team. If it helps you, send it to the one colleague who keeps asking “but who checks?”
Kindle and print editions are also available on Amazon.
Then test one workflow
The free Operational AI Readiness Assessment turns the book into about ten minutes of honest answers about one live AI workflow. There are five classification questions, then 24 control questions across eight domains, from inventory and ownership to the evidence spine, approval gates and failure readiness. A “yes” only counts in full if you could show the record today. You get your weakest domain, three next moves and the chapter to read for each. Nothing is stored unless you choose to save it.
Take the assessmentA self-assessment based on the book. It is not legal advice, an audit or a certification, and it does not tell you whether a law applies to you.
Compare the editions
Both editions share the same core method. The Standard edition is complete on its own and helps you govern one live AI workflow properly. The Premium edition is for teams taking that discipline across a whole program.
| Standard Free | Premium $49 | |
|---|---|---|
| Length | 12 chapters, 5 appendices | 17 chapters, 9 appendices |
| Readiness, risk, classification and the minimum viable control stack | ✓ | ✓ |
| Human oversight, runtime visibility and the evidence spine | ✓ | ✓ |
| Security, change management and approval gates for high-impact actions | ✓ | ✓ |
| The 30-day readiness sprint, and what auditors and regulators look for | ✓ | ✓ |
| Appendices A–E: policy rules, evidence logging schema, human-in-the-loop spec, vendor question bank, readiness test suite | ✓ | ✓ |
| Privacy by design in AI-enabled systems | — | ✓ |
| Bias detection, metrics and mitigation | — | ✓ |
| Governance monitoring and continuous compliance | — | ✓ |
| The operational maturity model | — | ✓ |
| Communicating findings to stakeholders | — | ✓ |
| Appendix F: incident response playbook for AI workflow failures | — | ✓ |
| Appendices G–H: readiness assessment scorecard and structured walkthrough template | — | ✓ |
| Appendix I: findings communication templates | — | ✓ |
Start with the free edition. If your team needs the program-level chapters and templates, the Premium edition picks up where it leaves off.
Where to go from here
The book is complete on its own. If you want to go further, there are honest next steps for different needs. Pick the one that fits, or none.
Free · weekly
Stay current: the Mercury Brief
The rules and the incidents keep moving. The Brief is FairByDesign’s free weekly signal: what happened, what we found, what matters and what we are investigating next, including the evidence questions this book raises.
Get the Mercury Brief free$10/month or $100/year
Go deeper: Mercury Intelligence
For people who answer for AI at work. Mercury Intelligence gives you the full investigations, and where one exists the reporting file behind them, plus in-depth research, governance impact analysis, the AI Retooling Library and early access to training and workshops.
See Mercury Intelligence$49 · for teams applying it
Apply it across a program: the Premium edition
The Standard edition helps you govern one workflow properly. The Premium edition is for teams taking that discipline across many. It adds an operational maturity model and scorecard, a structured assessment walkthrough, an AI incident-response playbook, and chapters on privacy by design, bias detection and continuous compliance monitoring. It also has stakeholder reporting and remediation templates and a fully worked case study with evidence traces.
Get the Premium edition, $49US$499 · for leaders
Decide with your context: the Executive AI Decision Program
For executives and governance, risk, security, audit and technology leaders facing a real AI decision. You get a private self-paced course, then a private session prepared around your organization, and personalized written findings on whether a use case is appropriate, accountable, measurable, governable and backed by sufficient operational evidence. It does not certify compliance or replace your legal, security or audit functions.
See the Executive programWhy it’s free, and how to keep it that way
FairByDesign investigates whether AI controls actually work, and that kind of scrutiny cannot be paid for by the companies being examined without turning into marketing. So we fund it through readers. We made this book free because the people who most need it are often the ones without a budget: the engineer who inherited the workflow, the analyst asked to “make it compliant”, the student who wants to understand the machinery before it governs them. If the book saved you a week of work, or a bad decision, you can help keep this kind of work free for the next person.
Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron.
Every way to support is at fairbydesign.org/patrons-2. Support never buys editorial control.
For organizations
If your team wants help applying this to its own workflows, start with the Executive AI Decision Program, which is designed as the first phase of a structured pathway. For institutions that want independent AI scrutiny to exist without buying a say in it, there is public-interest underwriting.
Questions people ask
Is the free edition cut down? No. It is the complete Standard edition: twelve chapters, five real-world scenarios, the 30-day sprint and all five appendices. The Premium edition adds program-level material for teams scaling the discipline across many workflows.
Do I need to sign up? No. Read or download without an account. The Mercury Brief is there if you want it.
Can I share it with my team? Yes. Please link to this page so colleagues get the current version.
Is this legal advice? No. The book provides general guidance on AI governance and operational readiness and does not constitute legal advice. Regulatory timelines move: for example, the EU’s Digital Omnibus on AI, in force since 27 July 2026, moved the application date for stand-alone high-risk systems to 2 December 2027.
I bought the Standard edition. What now? Thank you for backing the work early. If you would like the Premium edition, email info@fairbydesign.org and we will credit what you paid toward it.
Published by FairByDesign: independent reporting and research on how AI is changing power, work, security and accountability. See how the Evidence Lab tests whether controls hold.