Executive Summary A few years back, if a regulator asked a company about its AI oversight, a nicely worded policy document and an ethics statement on the website would usually get you through the conversation. That's genuinely not true anymore, and it's not true because of one single dramatic law. It's true because a handful of state-level regulators in the US, along with EU enforcers, started asking a much more annoying question this year: prove it. The thing forcing that qu