What needs to be true before production?

• The approved workflow and exclusions are documented, with a named owner and deputy.
• Review and customer-release authority is enforced in the process, not merely described in a presentation.
• Price/labour sources and updates are controlled; stale supplier quotes can be identified.
• The live environment has the agreed permissions, retention settings and access records.
• Revisions, duplicates, retries and reconciliation have been exercised.
• Users have practised normal and exception cases; the manual fallback remains usable.
• Support, incident response, change approval, renewal and exit costs are known.
• A small initial operating scope is agreed, with a scheduled review before expansion.

Check each layer of data handling. For example, Microsoft's Document Intelligence guidance describes that service's processing and retention behaviour; it does not establish how a custom application stores prompts, uploaded files, logs or backups around it. Ask the application owner to document the complete path.