Automated AI Governance, EU AI Act Compliance, and Cryptographic Model Lineage in Enterprise MLOps

As high-risk artificial intelligence systems proliferate across consumer credit underwriting, clinical diagnostics, and critical infrastructure, binding regulatory frameworks such as the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), the U.S. Federal Reserve SR 11-7 Model Risk Management supervisory guidance, and NIST AI RMF 1.0 mandate verifiable data provenance, bias auditing, technical documentation, and post-market monitoring. Conventional enterprise governance relies on manual review boards, static spreadsheet checklists, and retrospective Word documents that are decoupled from continuous integration and continuous delivery (CI/CD) machine learning pipelines. This manual governance bottleneck delays production model deployments by 6 to 14 weeks while failing to prevent unauthorized weight tampering, silent covariate shift, or disparate impact violations in live serving environments. This paper introduces a zero-trust Automated AI Governance and Cryptographic Model Lineage architecture for enterprise MLOps. Our framework constructs an immutable, Merkle-DAG Model Bill of Materials (MBOM) signed via Sigstore keyless OIDC identities, SLSA Level 3 build provenance, and in-toto supply-chain attestations, binding raw training datasets, feature transformations, hyperparameter configurations, and fairness evaluation reports directly to container digests. At runtime, Kubernetes Open Policy Agent (OPA) admission controllers and continuous statistical drift monitors enforce mathematically bounded demographic parity, Equalized Odds, and Population Stability Index (PSI) gates with automatic circuit-breaker rollback. Validated against an enterprise Model Risk Management (MRM) case study modeled on Capital One and Mastercard credit and fraud MLOps pipelines across 180 production models, our architecture cuts compliance audit preparation latency from 42 days to 14 minutes, blocks 100% of unsigned or bias-violating model promotions in < 350 milliseconds, and maintains disparate impact ratios above 0.91 under seasonal macroeconomic drift. Research Domain & Specialization Track Master of Science in Information Technology (MSIT) — AI Governance, Regulatory Compliance, and Enterprise MLOps. Core Technical Highlights Empirical Production Case Studies: Rigorous architectural blueprints and telemetry evaluation across enterprise cloud deployments. Four-Tier Reference Architecture: Formal specification from edge ingress to distributed hardware execution pools. Mathematical Formulation: Formally derived algorithmic and optimization models with closed-loop verification. Multi-Modal Benchmarking: Comparative empirical baselines under fault-injection and synthetic workload scaling. Author Information Author: Sonu Kumar SinghRole: Senior Consultant Affiliation: Independent Researcher Publication Status: Preprint / Working Paper (MSIT AI & Cloud Systems Research Series) Reproducibility & Open Science All included architecture diagrams, telemetry schemas, and benchmark curves are open-access under the Creative Commons Attribution 4.0 International (CC BY 4.0) license.