What’s your most practical framework for AI legal/compliance readiness (without killing shipping speed)?

I’m trying to compare real-world approaches (not theory) for AI legal/compliance readiness in product teams.

A lot of orgs still run legal as a late-stage blocker. In practice, that seems to create last-minute delays, policy theater, and weak incident prep.

Current lightweight framework I’m seeing work:

• maintain a live AI use-case inventory
• assign a risk tier per use case
• define required controls by tier (human review, disclosure, logging, escalation)
• run one tabletop incident drill quarterly
• track evidence (versions, decisions, overrides)

For people doing this in-house: what has actually worked for you?

I’m especially interested in:

1. how you prevent governance from becoming bureaucracy,
2. how you handle contract language for AI features,
3. what metrics leadership actually pays attention to.

(General discussion only; not legal advice.)