{
  "schemaVersion": 1,
  "version": "2026-09-15",
  "id": "https://hk.onyxdevslab.com/data/enterprise-ai-production-readiness.json",
  "name": "Enterprise AI production-readiness checklist",
  "datePublished": "2026-09-15",
  "dateModified": "2026-09-15",
  "evidenceClass": "Provider-authored implementation checklist",
  "publisher": {
    "name": "Onyx Devs Lab",
    "legalName": "ONYX DEVS LAB LIMITED",
    "url": "https://hk.onyxdevslab.com/",
    "leiCode": "254900Z30CLK7HKE9H46"
  },
  "landingPages": {
    "en": "https://hk.onyxdevslab.com/en/guides/enterprise-ai-production-readiness/",
    "zhHant": "https://hk.onyxdevslab.com/zh-hk/guides/enterprise-ai-production-readiness/",
    "zhHans": "https://hk.onyxdevslab.com/zh-cn/guides/enterprise-ai-production-readiness/"
  },
  "languages": {
    "en": {
      "name": "What must be true before an enterprise AI system goes live?",
      "summary": "A successful demonstration establishes possibility, not production readiness. Release only when the complete workflow has an owner, mandatory controls pass, failure and recovery are tested, and operators can run the system within an agreed cost and service envelope.",
      "decisionSignals": [
        {
          "name": "Owned workflow",
          "meaning": "Business, technical, data, and risk owners"
        },
        {
          "name": "Mandatory gates",
          "meaning": "Quality, privacy, authority, and safety"
        },
        {
          "name": "Operable system",
          "meaning": "Monitoring, recovery, cost, and support"
        }
      ],
      "sections": [
        {
          "heading": "Evidence required for the release decision",
          "introduction": "Every gate should point to a reproducible record, not a confidence statement.",
          "checks": [
            {
              "name": "Representative capability",
              "requirement": "Evaluate common, edge, missing-data, adversarial, and high-impact cases with defined metrics, samples, thresholds, versions, and failure analysis."
            },
            {
              "name": "Data and authority",
              "requirement": "Verify provenance, consent and purpose where relevant, retention, tenant isolation, least privilege, confirmation, audit, and prohibited actions."
            },
            {
              "name": "End-to-end workflow",
              "requirement": "Test integration, queues, retries, idempotency, latency, availability, cost, human review, escalation, and resulting state in systems of record."
            }
          ]
        },
        {
          "heading": "Operational conditions after go-live",
          "introduction": "Production readiness includes the people and procedures that respond when reality differs from the test set.",
          "checks": [
            {
              "name": "Observability and response",
              "requirement": "Monitor quality signals, system health, tool failures, cost, data drift, security events, and user exceptions with named responders."
            },
            {
              "name": "Fallback and recovery",
              "requirement": "Provide safe degradation, rollback, kill and revoke paths, backups where applicable, incident records, and verified recovery objectives."
            },
            {
              "name": "Adoption and change",
              "requirement": "Train operators, publish limitations, define support and feedback, control model and prompt changes, rerun regression tests, and review authority regularly."
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "Freeze the release candidate",
          "instruction": "Record model, prompt, retrieval, tools, policies, data, infrastructure, and evaluation-set versions."
        },
        {
          "position": 2,
          "name": "Run mandatory gates",
          "instruction": "Execute workflow, control, failure, recovery, performance, cost, and operator tests; preserve results and unresolved exceptions."
        },
        {
          "position": 3,
          "name": "Sign the release decision",
          "instruction": "Business, technical, data, and relevant risk owners approve the exact authority tier and accepted residual risk."
        },
        {
          "position": 4,
          "name": "Release progressively",
          "instruction": "Limit users, volume, data, and actions first; watch leading indicators and expand only after the evidence window passes."
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "Is model accuracy the main go-live criterion?",
          "answer": "It is one criterion. A useful model can still be unsafe or uneconomic when permissions, integration, reliability, recovery, review effort, or operating cost fail."
        },
        {
          "question": "Must every issue be closed before launch?",
          "answer": "No. Non-mandatory residual risks may be accepted by authorised owners when impact, mitigation, monitoring, expiry, and review date are recorded."
        },
        {
          "question": "How often should readiness be reviewed?",
          "answer": "After material changes to models, prompts, data, tools, permissions, workflow, infrastructure, regulation, or observed failure patterns—and on a scheduled basis."
        },
        {
          "question": "Is this a security certification?",
          "answer": "No. It is a provider-authored delivery checklist, not an audit, certification, or replacement for organisational governance."
        }
      ]
    },
    "zhHant": {
      "name": "企業 AI 系統上線前必須滿足哪些條件？",
      "summary": "成功示範只證明可能性，不等於生產就緒。只有完整流程有負責人、強制控制通過、失敗與恢復經過測試，而且操作人員可在約定成本及服務範圍內營運，才應發布。",
      "decisionSignals": [
        {
          "name": "流程有人負責",
          "meaning": "業務、技術、數據及風險責任"
        },
        {
          "name": "強制關口",
          "meaning": "質量、私隱、權限及安全"
        },
        {
          "name": "系統可營運",
          "meaning": "監測、恢復、成本及支援"
        }
      ],
      "sections": [
        {
          "heading": "發布決定所需證據",
          "introduction": "每個關口都應指向可重複記錄，而非信心陳述。",
          "checks": [
            {
              "name": "代表性能力",
              "requirement": "用已定義指標、樣本、門檻、版本及失敗分析，評估常見、邊界、缺失數據、對抗及高影響案例。"
            },
            {
              "name": "數據及權限",
              "requirement": "核實來源、適用時的同意與目的、保留、租戶隔離、最小權限、確認、審計及禁止動作。"
            },
            {
              "name": "端到端流程",
              "requirement": "測試整合、隊列、重試、冪等、延遲、可用性、成本、人工覆核、升級及記錄系統的最終狀態。"
            }
          ]
        },
        {
          "heading": "上線後的營運條件",
          "introduction": "生產就緒包括當真實情況偏離測試集時作出回應的人員及程序。",
          "checks": [
            {
              "name": "可觀測性及回應",
              "requirement": "監測質量訊號、系統健康、工具失敗、成本、數據漂移、安全事件及使用者例外，並指定回應人。"
            },
            {
              "name": "降級及恢復",
              "requirement": "提供安全降級、回退、停止與撤銷路徑、適用備份、事故記錄及已驗證恢復目標。"
            },
            {
              "name": "採用及變更",
              "requirement": "培訓操作人員、公布限制、定義支援與反饋、控制模型與提示詞變更、重跑回歸測試及定期覆核權限。"
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "凍結發布候選版本",
          "instruction": "記錄模型、提示詞、檢索、工具、政策、數據、基礎設施及評估集版本。"
        },
        {
          "position": 2,
          "name": "運行強制關口",
          "instruction": "執行流程、控制、失敗、恢復、性能、成本及操作人員測試，保留結果與未解例外。"
        },
        {
          "position": 3,
          "name": "簽署發布決定",
          "instruction": "業務、技術、數據及相關風險負責人批准準確權限層級及已接受剩餘風險。"
        },
        {
          "position": 4,
          "name": "逐步發布",
          "instruction": "先限制使用者、數量、數據及動作；觀察領先指標，證據窗口通過後才擴大。"
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "模型準確度是否主要上線標準？",
          "answer": "它是其中一項。權限、整合、可靠性、恢復、覆核工作或營運成本失敗時，有用模型仍可能不安全或不合算。"
        },
        {
          "question": "是否必須在上線前關閉所有問題？",
          "answer": "不是。獲授權負責人可接受非強制剩餘風險，但需記錄影響、緩解、監測、到期及覆核日期。"
        },
        {
          "question": "應多久覆核一次就緒狀態？",
          "answer": "模型、提示詞、數據、工具、權限、流程、基礎設施、規例或已觀察失敗模式有實質變更後，以及按固定週期覆核。"
        },
        {
          "question": "這是安全認證嗎？",
          "answer": "不是。這是服務商自撰交付清單，不是審計、認證或機構治理的替代品。"
        }
      ]
    },
    "zhHans": {
      "name": "企业 AI 系统上线前必须满足哪些条件？",
      "summary": "成功演示只证明可能性，不等于生产就绪。只有完整流程有负责人、强制控制通过、失败与恢复经过测试，而且操作人员能够在约定成本和服务范围内运营，才应该发布。",
      "decisionSignals": [
        {
          "name": "流程有人负责",
          "meaning": "业务、技术、数据和风险责任"
        },
        {
          "name": "强制关口",
          "meaning": "质量、隐私、权限和安全"
        },
        {
          "name": "系统可运营",
          "meaning": "监控、恢复、成本和支持"
        }
      ],
      "sections": [
        {
          "heading": "发布决策所需证据",
          "introduction": "每个关口都应该指向可重复记录，而不是信心陈述。",
          "checks": [
            {
              "name": "代表性能力",
              "requirement": "用已经定义的指标、样本、门槛、版本和失败分析，评估常见、边界、缺失数据、对抗和高影响案例。"
            },
            {
              "name": "数据与权限",
              "requirement": "核实来源、适用时的同意与目的、保留、租户隔离、最小权限、确认、审计和禁止动作。"
            },
            {
              "name": "端到端流程",
              "requirement": "测试集成、队列、重试、幂等、延迟、可用性、成本、人工复核、升级和记录系统的最终状态。"
            }
          ]
        },
        {
          "heading": "上线后的运营条件",
          "introduction": "生产就绪包括当真实情况偏离测试集时做出响应的人员和程序。",
          "checks": [
            {
              "name": "可观测性与响应",
              "requirement": "监控质量信号、系统健康、工具失败、成本、数据漂移、安全事件和用户异常，并指定响应人员。"
            },
            {
              "name": "降级与恢复",
              "requirement": "提供安全降级、回退、停止与撤销路径、适用备份、事故记录和经过验证的恢复目标。"
            },
            {
              "name": "采用与变更",
              "requirement": "培训操作人员、公布限制、定义支持和反馈、控制模型与提示词变更、重跑回归测试和定期复核权限。"
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "冻结发布候选版本",
          "instruction": "记录模型、提示词、检索、工具、政策、数据、基础设施和评估集版本。"
        },
        {
          "position": 2,
          "name": "运行强制关口",
          "instruction": "执行流程、控制、失败、恢复、性能、成本和操作人员测试，保留结果与未解决异常。"
        },
        {
          "position": 3,
          "name": "签署发布决定",
          "instruction": "业务、技术、数据和相关风险负责人批准准确权限层级和已经接受的剩余风险。"
        },
        {
          "position": 4,
          "name": "逐步发布",
          "instruction": "先限制用户、数量、数据和动作；观察领先指标，证据窗口通过后再扩大。"
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "模型准确度是主要上线标准吗？",
          "answer": "它是其中一项。权限、集成、可靠性、恢复、复核工作或运营成本失败时，有用模型仍然可能不安全或不划算。"
        },
        {
          "question": "必须在上线前关闭所有问题吗？",
          "answer": "不是。获得授权的负责人可以接受非强制剩余风险，但需要记录影响、缓解、监控、到期和复核日期。"
        },
        {
          "question": "应该多久复核一次就绪状态？",
          "answer": "模型、提示词、数据、工具、权限、流程、基础设施、法规或已观察失败模式有实质变更后，以及按照固定周期复核。"
        },
        {
          "question": "这是安全认证吗？",
          "answer": "不是。这是服务商自编交付清单，不是审计、认证或组织治理的替代品。"
        }
      ]
    }
  },
  "limitations": [
    "This asset is provider-authored and is not independent validation or a claim of client results.",
    "It is an implementation aid, not legal, privacy, security, financial, procurement, or regulatory advice.",
    "Thresholds and controls must be adapted to the organisation, workflow, jurisdiction, and risk owners."
  ]
}