ML model release governance in Jira

Shipping a model is not shipping code. Between "the eval numbers look good" and "this is live for customers" sit questions your future self — or a regulator — will ask: who reviewed the evaluation? who signed off the bias analysis? what did the red-team find, and who accepted the residual risk?

With the EU AI Act phasing in and internal AI review boards becoming standard, teams need release governance that produces human accountability — without building a bespoke approvals tool. If your ML work already lives in Jira, Greenlight adds exactly that layer.

How Greenlight maps to model governance

• Gates are your review board. Evaluation, bias & fairness, red-team, privacy, documentation — each a named gate owned by an accountable reviewer, not a checkbox in a script.
• Comments where the decision happens. Reviewers discuss a gate in its own thread, @-mentioning whoever needs to weigh in, so the reasoning sits with the record instead of in a chat scrollback.
• Evidence that stands still. Attach eval dashboards, bias reports, and red-team docs as evidence links; Greenlight freezes the evidence state in the audit record at the moment of sign-off.
• Drift stays visible. If linked work regresses after a gate was approved (a reopened issue, an unchecked item), the approval isn't silently revoked — it's flagged for a human to revoke or re-confirm.
• Governance lives in the template. "Bias & fairness review" sits on the org-wide template, versioned, so every model release starts from the same set of gates rather than whatever the team remembered.

Template pack: Model release

Recreate via Greenlight → Administration → New global template:

Gate	Suggested owner	Checklist seeds	Required
Model evaluation	ML lead	Eval suite run on final checkpoint · Benchmarks vs. baseline recorded · Regression thresholds met	Yes
Bias & fairness review	Responsible AI lead	Disaggregated metrics reviewed · Known-failure modes documented · Mitigations recorded	Yes
Security & red-team	Security lead	Red-team findings triaged · Jailbreak/abuse tests run · Residual risk accepted in writing	Yes
Data & privacy	Privacy officer	Training-data lineage documented · PII handling reviewed · Retention policy confirmed	Yes
Model card & docs	Docs owner	Model card published · Intended-use and limitations stated · Changelog updated	Yes
Rollback plan	Platform lead	Previous version deployable · Kill switch tested · Monitoring alerts wired	Yes
Regulatory review	Legal counsel	AI Act risk class assessed · Notified-body requirements checked	Optional

Keep Regulatory review optional on the template and mark it required on the releases that need it, so low-risk experiments aren't taxed with it.

Why in Jira, and why Forge

Your models' issues, experiments, and incidents are already in Jira; the governance record belongs next to them, not in another SaaS. Greenlight runs entirely on Atlassian Forge with zero data egress — nothing about your models, evals, or reviews leaves your Atlassian site.