ML model release governance in Jira

Shipping a model is not shipping code. Between "the eval numbers look good" and "this is live for customers" sit questions your future self — or a regulator — will ask: who reviewed the evaluation? who signed off the bias analysis? what did the red-team find, and who accepted the residual risk?

With the EU AI Act phasing in and internal AI review boards becoming standard, teams need release governance that produces human accountability — without building a bespoke approvals tool. If your ML work already lives in Jira, Greenlight adds exactly that layer.

How Greenlight maps to model governance

• Gates are your review board. Evaluation, bias & fairness, red-team, privacy, documentation — each a named gate owned by an accountable reviewer, not a checkbox in a script.
• Panels for shared accountability. A "Responsible AI" gate can require 2-of-3 named reviewers to approve — Greenlight tracks each decision and rolls them up.
• Evidence that stands still. Attach eval dashboards, bias reports, and red-team docs as evidence links; Greenlight freezes the evidence state in the audit record at the moment of sign-off.
• Drift stays visible. If linked work regresses after a gate was approved (a reopened issue, an unchecked item), the approval isn't silently revoked — it's flagged for a human to revoke or re-confirm.
• Locked governance gates. An admin can lock "Bias & fairness review" on the org template so no project team can quietly drop it.

Template pack: Model release

Recreate via Greenlight → Administration → New global template:

Gate	Suggested owner	Checklist seeds	Required
Model evaluation	ML lead	Eval suite run on final checkpoint · Benchmarks vs. baseline recorded · Regression thresholds met	Yes 🔒
Bias & fairness review	Responsible AI panel, 2-of-3	Disaggregated metrics reviewed · Known-failure modes documented · Mitigations recorded	Yes 🔒
Security & red-team	Security lead	Red-team findings triaged · Jailbreak/abuse tests run · Residual risk accepted in writing	Yes 🔒
Data & privacy	Privacy officer	Training-data lineage documented · PII handling reviewed · Retention policy confirmed	Yes 🔒
Model card & docs	Docs owner	Model card published · Intended-use and limitations stated · Changelog updated	Yes
Rollback plan	Platform lead	Previous version deployable · Kill switch tested · Monitoring alerts wired	Yes
Regulatory review	Legal counsel	AI Act risk class assessed · Notified-body requirements checked	Optional

Make Regulatory review a conditional gate — required only when the release's linked work carries a high-risk label — so low-risk experiments aren't taxed with it.

Why in Jira, and why Forge

Your models' issues, experiments, and incidents are already in Jira; the governance record belongs next to them, not in another SaaS. Greenlight runs entirely on Atlassian Forge with zero data egress — nothing about your models, evals, or reviews leaves your Atlassian site.