AI Is Already Running. Here Is a Free Field Manual for Governing It.

Somewhere today, an AI system helped decide which job applications a recruiter saw first. Another flagged a payment as suspicious. Another drafted the reply a customer received about a refund. None of this is futuristic, and most of it was switched on quietly, by teams trying to get through the week. The question is no longer whether organizations use AI. It is whether anyone can see what it is doing, stop it when it misbehaves, and show afterwards what happened.

That is the question our field manual is built around, and today we are inviting you to read it, free. Operational AI Readiness: A Practitioner Guide to Governing AI That Is Already Live, by Viktoria Bakos, is available in full as a Standard edition: 12 chapters, five appendices, no account, no email wall.

From principles to operation

For several years, AI governance mostly meant writing things down: principles, policies, ethics statements. Those documents matter, but they describe intentions. They cannot tell you what a system did last Tuesday. The book takes a blunt position on this: if a system influences consequential decisions, “governance is not a policy document sitting politely upstream from engineering” (Bakos, 2026, p. 14). It is the discipline built into how the system is designed, reviewed, monitored, changed and stopped. Without that, the book says, a system may still function, but it is not operationally ready. “It is just active” (Bakos, 2026, p. 14).

The timing matters. In Europe, the Digital Omnibus on AI entered into force on 27 July 2026 and moved the main obligations for stand-alone high-risk systems, such as those used in employment and education, to 2 December 2027 (Hunton Andrews Kurth, 2026). Some will read that as breathing room. We read it as a runway. The systems those rules will cover are mostly already live, and the evidence a reviewer will ask for cannot be created retroactively. Everywhere else, the logic is the same without a deadline: when a decision is challenged, “we had a policy” is not an answer.

Three ideas worth stealing

Reconstruction is the test. The book’s core claim is that “a workflow that cannot be reconstructed under scrutiny is not operationally ready” (Bakos, 2026). If something goes wrong tomorrow, can you show which system produced the output, which version was running, what sources shaped it, whether a human reviewed it and what happened next? If not, the book’s phrase for it is “storytelling with timestamps” (p. 45).

The evidence spine. The book names the records that make reconstruction possible, defining the evidence spine as “the minimum set of records and operating facts” needed to answer serious questions after something happens (Bakos, 2026, p. 12). Chapter 6 builds it out, and Appendix B turns it into a logging schema with field-by-field logic.

Embarrassingly simple questions. Before any framework, ask of one live workflow: What is it allowed to do? What is it actually doing? Who reviews the outputs that matter? What gets recorded? What changed last week? Who can stop it? The book admits these sound simple, and notes that many organizations discover under scrutiny that they cannot answer them cleanly (p. 19).

Who it is for

It is written for the engineer who inherited a workflow nobody documented, the analyst who was told to “make it compliant,” and the risk, audit and governance staff who have to sign off on it. It is also for managers and boards who want to ask better questions than “are we using AI responsibly?” And it is for anyone who simply wants to understand the machinery that increasingly decides things about them. You do not need to be technical to follow the argument.

The appendices are the practical layer. A few of them:

• Appendix A: sample policy rules in YAML, with the reason each rule exists.
• Appendix C: a human-in-the-loop workflow specification, modeled on a payment-approval use case.
• Appendix D: a vendor due-diligence question bank for the conversation your supplier would rather not have.
• Appendix E: a minimal readiness test suite, so you can check your controls instead of assuming them.

The free Standard edition is complete on its own, not a teaser. A $49 Premium edition adds five chapters, including privacy, bias and continuous monitoring, for teams building a wider program.

Start in 30 minutes

• Pick one workflow that touches money, jobs, access, customers or security: the one you would least like to explain to an auditor.
• Take the readiness assessment (about ten minutes). It asks five classification questions and 24 control questions, and a “yes” only counts in full if you could show the record today.
• Read the chapter for your weakest domain. The assessment names it, with three next moves.
• Plan the 30-day sprint in Chapter 10. Its aim is not to “become compliant” in a month, which the book calls a foolish claim, but to move one workflow from vague confidence to operational visibility (Bakos, 2026, p. 68).

An honest limit: the assessment is a self-assessment, “not legal advice, an audit or a certification,” and the assessment page states that nothing you answer is sent anywhere or stored. The book is general guidance, not legal advice. A good score tells you where you stand; it does not certify anything.

What to do with this

• If an AI system affects you (as an applicant, patient, customer or citizen), you can ask: was a person involved in this decision, and could you show me what they reviewed?
• If you run or approve AI at work, ask the six questions above about one workflow this week, and write down which answers exist only in someone’s memory.
• If you sit on a board or leadership team, ask for one reconstructed decision, not another policy summary.

References

Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live (Free Standard ed.). FairByDesign. https://fairbydesign.org/operational-ai-readiness/

FairByDesign. (2026). Operational AI readiness assessment. https://fairbydesign.org/readiness-assessment/

Hunton Andrews Kurth. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy & Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

---

FairByDesign is reader-funded. If this helped, get the free Mercury Brief or see ways to support. Support never buys editorial control.