Get the ultimate guide to shifting left with data contracts — O'Reilly Book

Get the ultimate guide to shifting left with data contracts — O'Reilly Book

Confidently comply with the EU AI Act and evolving US AI regulations

When auditors ask how risk numbers and AI decisions were produced, show traceable evidence from source code to repo
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form. Please try again.

Gable traces every data element through your code

II
// ===== UserProfileService.java =====
package demo;
public class UserProfileService {
  public User getUserProfile(String id) {
    User u = repository.findById(id);
    if (u == null) throw new NotFound("user");
    cacheInRedis(u);
    return u;
  }
  public void updateUserProfile(User u){
    repository.save(u);
    archiveToS3(u);
    indexInElasticsearch(u);
  }
  private void archiveToS3(User u){ /* s3://profiles/{id}.json */ }
  private void cacheInRedis(User u){ /* redis.set("user:"+u.id, json(u)) */ }
  private void indexInElasticsearch(User u){ /* es.index("users", u.id, u) */ }
}

// ===== EventProcessorService.java =====
package demo;
public class EventProcessorService {
  public void processUserEvent(Event e){
    insertUserEventToDb(e);
    archiveEventToS3(e);
  }
  private void insertUserEventToDb(Event e){ /* INSERT INTO user_events ... */ }
  private void archiveEventToS3(Event e){ /* s3://events/{id}.json */ }
}

// ===== FileImportService.java =====
package demo;
public class FileImportService {
  public void processBulkImport(File f){
    List rows = parse(f);
    insertImportRecordsToDb(rows);
    indexImportForSearch(rows);
  }
  public void processDataImportFromUrl(String url){ /* fetch+parse */ }
  private void insertImportRecordsToDb(List rows){ /* batch insert */ }
  private void indexImportForSearch(List rows){ /* es.bulk */ }
}
// ===== UserProfileService.java =====
package demo;
public class UserProfileService {
  public User getUserProfile(String id) { /* ... */ }
  public void updateUserProfile(User u){ /* ... */ }
  private void archiveToS3(User u){ /* ... */ }
  private void cacheInRedis(User u){ /* ... */ }
  private void indexInElasticsearch(User u){ /* ... */ }
}

// ===== EventProcessorService.java =====
package demo;
public class EventProcessorService { /* ... */ }

// ===== FileImportService.java =====
package demo;
public class FileImportService { /* ... */ }

Lineage for risk reporting and AI decisions

Static code analysis for AI Act and U.S. supervisory expectations (GLBA, FFIEC/OCC, SR 11-7, NYDFS, PCI)

I cannot prove how risk assessments and regulatory filings were produced

Examiners ask which fields and code transformations drove a reported figure. The path spans services, and we cannot show it quickly.

Breach impact and supervisory reporting are hard to prove at the field level

When data issues happen, we need to show which decisions, reports, and customers were affected and what controls were in place.

Connect model risk and third-party oversight with shared lineage and proof

AI Act technical files, SR 11-7 governance, and third-party evidence are not tied to the code that produced results. Exams slow down and MRAs risk grows.

How Gable fixes this

Replace tribal knowledge with traceable, defensible data flows

Output catalog

Auto-surface every event/response your services emit so teams can see the canonical objects.

Contracts in repo

Enforce rules for each output, including fields, requiredness, and versioning, so unsafe changes are caught early.

Show regulators the controls applied to each affected field and decision

PR Impact Map

Lists affected services, models, and jobs with the reason.

Suggested Reviewers

Auto-identify owners who should sign off.

Generate regulator and vendor evidence directly from your production code

Safe-Change Hints

Recommendations to version or scope changes to reduce impact.

Optional Merge Block

Hold merges until risk is addressed.

“When examiners ask which fields drove a risk number, I can answer with code-level lineage and control evidence, not a slide deck.”

Adriana Bello

Managing VP, Product – Enterprise Data

Features built for exams and audits

Code-level field lineage

Static analysis traces fields through the transformations that produced each output.

Supervisory reporting trace

Show how a regulatory filing or risk number was calculated from original fields for supervisory reporting, consumer protection and privacy enforcement, securities disclosure, and AML monitoring.

Controls evidence per field

DLP, masking, encryption, and access proof attached to lineage.

AI Act + SR 11-7 packets

Technical files, validation, and change-control evidence packaged for examiners and procurement.

Guides for security and model risk