Bayer’s quiet model registry, and why the audit went faster than the board expected.

Bayer does not talk publicly about its AI program the way a consumer company would, which is consistent with how the program is built. Sometime in 2023 the second line of defense — risk and compliance, not the data-science org — stood up a model registry: a single record of every model in or near production, its owner, its data lineage, its validation status, and the controls applied to it. It was an unglamorous artifact, and it is the reason the rest of this case is short.

The structural read is that Bayer built the operating layer before it needed it. In a regulated pharmaceutical context, models touch pharmacovigilance, manufacturing, and commercial decisions, and each of those eventually meets a regulator or an internal review. The registry meant that when a review came, the answer to “what models do you run and how do you control them” was a document, not a project.

The detail the board noticed was speed. A model review the organization had budgeted three weeks for closed in four days, because the evidence already existed in one place and in one format. The reviewers were not won over by a narrative; they were handed a record and could verify it. Nothing about the deployment changed. What changed was that the cost of being inspected had been paid in advance, in small installments, rather than all at once under pressure.

Bayer is the case that looks like nothing happened, which is the point. The registry is not a product, not a press release, and not a strategy. It is the second line building the artifact the operating-system model says should exist, and then letting it sit there doing its job until the moment it earns its cost back. Most organizations build this artifact after the first painful review. Bayer built it before, and the four-day review is the dividend.