CTOs and directors of technology own the risk story, not the implementation detail. This track is executive-grade. It is dense but every page leads with a one-line TL;DR, every regulatory citation has an effective date, and every claim is sourced. The ten steps move from the board-level case for the program to the actual board readout template you reuse.
The first five steps build the strategic posture. The last five give you the artifacts your team produces to support it. Read in order on the first pass; come back to specific steps when the board asks a question.
The track
- Executive overview: why evals are board-level (12 min). The case for the eval program as defensible risk posture, not engineering hygiene. The non-determinism, subjectivity, and drift arguments framed for non-engineers 1.
- EU AI Act timeline (16 min). GPAI obligations have applied since August 2, 2025. Enforcement and the Article 50 transparency rules began August 2, 2026 2. The AI Omnibus entered into force July 27, 2026 and deferred high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I) 3. The next date on the calendar is December 2, 2026: new prohibitions covering deepfakes and child safety material, and a transitional compliance deadline for certain providers under Article 50(2) 2. If you ship generated content, the Commission's Code of Practice on Transparency of AI-generated Content, published in final form in June 2026 and signed by more than 180 organizations by late July, is the voluntary route to showing you comply 4. The document you actually file 5.
- NIST AI RMF mapped to eval activities (16 min). The four functions (Govern, Map, Measure, Manage) cross-walked to specific eval evidence. What goes in an audit binder. AI RMF 1.0 is still the published version; NIST says it is being revised as part of the White House AI Action Plan and gives no new version number or date (fetched as of 2026-10-01), so stamp each mapping row with the framework version, and the revision lands as a diff, not a rewrite. For generative AI systems the companion document is NIST AI 600-1, the Generative AI Profile (July 26, 2024) 6.
- OWASP LLM Top 10: your exposure (14 min). Each item: what it is, how evals detect it, what to file in the risk register 7. The 2025 edition is the current LLM list, and OWASP's page announces no newer one as of 2026-10-01. If any product takes actions, add OWASP's separate Top 10 for Agentic Applications (December 9, 2025), ASI01 to ASI10 and led by agent goal hijack and tool misuse, to the exposure review 8.
- What frontier-lab evals look like (14 min). Anthropic's Responsible Scaling Policy 9 and OpenAI's Preparedness Framework 10 are the vocabulary your peers use and the standard your investors and customers will reference. Anthropic rewrote its policy as version 3.0 on February 24, 2026, adding public Frontier Safety Roadmaps and Risk Reports published every 3 to 6 months; the current version is 3.4, effective July 8, 2026 (fetched as of 2026-10-01) 9 11.
- Building an AI risk register (12 min). The template, scoring methodology, and how each row links to a product-risk artifact.
- Customer-facing trust artifacts (12 min). Trust portal page content, model card framing, what to share publicly and what to gate behind an NDA.
- Red-team program design (14 min). Internal vs external, cadence, scope. What goes in the contract with an external red-team vendor.
- Cost and latency in the eval scorecard (10 min). Per-request cost and p95 latency tracked in the same table as quality, with alert thresholds and the Pareto framing for model choice. The numbers your eval program should put in front of you before a model swap.
- Talking to your board about AI risk (16 min). The board-readout template: one-pager, risk matrix, mitigation-status table. What to leave out.
What comes after the track
Once the ten pages are read, the natural next moves: write the AI risk register for the current quarter; pick the trust artifact rollout date; commission an external red-team for the next major release. Anthropic's October 2023 writeup on the challenges of evaluating AI systems is a useful supplement on what frontier-lab honesty looks like 12.
CAUTION
The EU AI Act timelines are real. If your product touches EU users, the GPAI obligations are live and Commission enforcement of them has run since August 2, 2026; the 2026 Omnibus deferred the high-risk tranches but moved nothing about GPAI. Steps 2 and 3 are not optional; they are the audit-binder material your legal team will request.