Checklist

A RAG system that demos well and fails in production usually skipped items on this list. Content curation, permissions, retrieval quality, grounding, evaluation, freshness, cost, and operations, each with evidence.

Smart contracts are hard to change and hold value, which makes pre-deployment security decisive. This checklist covers specification, access control, common vulnerability classes, upgradeability, oracles, testing, independent audit, and monitoring.

AI systems introduce controls SOC 2 auditors are now asking about. This checklist maps LLM applications and agents to the trust services criteria: security, availability, processing integrity, confidentiality, privacy, and change management.

A token launch is a legal, economic, technical, and operational event at once. This checklist covers legal structure, tokenomics, contract security, distribution and vesting, custody, liquidity, compliance, communications, and operations.

Most web application breaches exploit well-understood weaknesses. This checklist covers authentication, authorization, input handling, security headers, dependencies, secrets, logging, infrastructure, and testing before release.

Any AI system that touches protected health information is inside HIPAA. This checklist covers scope and business associate agreements, minimum necessary, access, encryption, audit logging, risk analysis, breach procedures, and vendors.

Intellectual property is protected offshore by contract and by architecture together. This checklist covers contracts under your law, buyer-owned assets, access controls, data handling, confidentiality practices, and audit.

LLM applications introduce attack surfaces conventional security reviews miss. This checklist covers prompt injection, data leakage, output validation, tool scoping, supply chain, logging, and testing, each with evidence.

MLOps maturity is the difference between models that ship once and models that ship safely every week. This checklist scores versioning, reproducibility, pipelines, evaluation gates, registry, deployment, monitoring, and governance by level.

A mobile launch is a store submission, a rollout, and an operating commitment at once. This checklist covers store readiness, device quality, performance, security, analytics, crash reporting, staged rollout, and support.

Next.js gives you the tools for fast pages and the freedom to misuse them. This checklist covers rendering strategy, caching semantics, images and fonts, bundle size, Core Web Vitals budgets, data fetching, and real-user monitoring.

The first thirty days decide whether an offshore team becomes part of your engineering organization or a vendor at arm's length. This checklist covers contracts, access, security, tooling, overlap, first deliverables, and knowledge capture.

The contract is where outsourcing risk is either handled or hidden. This checklist covers scope and acceptance, IP, data protection, security, change control, exit, liability, and governing law for AI and software engagements.

Most AI projects are lost in the first two weeks, when outcomes stay vague and access never arrives. This checklist covers what must be true at kickoff: outcome, owner, data, access, security, evaluation plan, team, and cadence.

An AI RFP built from feature checklists rewards marketing. One built to reveal method rewards the vendors who will deliver. This checklist covers outcome, context, method questions, security, operations, terms, artifacts, and scoring.

Service levels for AI systems must cover quality and change, not only uptime. This checklist covers availability, latency, quality thresholds, oversight response times, incident handling, change notification, reporting, and remedies.

AI teams fail from the wrong roles at the wrong time and from hiring on credentials rather than production evidence. This checklist covers roles by phase, evidence to require, candidate evaluation, domain fit, build-versus-augment, and onboarding.

Models inherit every flaw in their data. This checklist covers provenance and rights, representativeness, labeling quality, leakage prevention, privacy, splits and versioning, and documentation for training and evaluation data.

Buying AI means buying a method and a team as much as a product. This checklist gives buyers the questions and evidence to demand across capability, method, security, IP, operations, stability, and references.

The EU AI Act applies to many organizations outside Europe. This checklist walks through scope and role, risk classification, prohibited practices, high-risk obligations, transparency duties, general-purpose model duties, and timelines.

A forward deployed engineer is only as effective as the first two weeks allow. This checklist covers mission scope, business owner, access, embedding, discovery plan, specification, and the first review, for both the client and the engineer.

Evaluation is how a probabilistic system is proven correct. This checklist covers specification coverage, the golden dataset, task metrics, calibrated graders, safety tests, CI gates, production sampling, and reporting.

Fairness is a tested property, not a stated value. This checklist covers scope and protected groups, metric selection, data assessment, pre-launch and production testing, remediation, documentation, and governance for AI systems that affect people.

AI governance is a set of structures and controls, not a policy document. This checklist covers the register, ownership, policies, risk tiering, evaluation, oversight, audit, vendor risk, and cadence an enterprise needs.