01
Establish the real AI estate
Include central tools, AI features inside existing software, assistants, embedded models and informal employee use. Record the owner, purpose, users, supplier and status.
The same technology can carry different risk depending on its intended use. Meeting notes are not equivalent to candidate assessment or a safety-related decision.
02
Determine role and classification
Establish whether the organisation is a provider, deployer, importer, distributor or combines roles. Then assess prohibited practices, high-risk systems, transparency duties and other use.
Do not classify by product name alone. Intended purpose, deployment, affected people and modifications matter. Borderline cases need specialist legal assessment.
03
Put common controls in place
Even non-high-risk use benefits from basic governance.
- business owner and approver;
- purpose, data and permitted users;
- supplier terms and change monitoring;
- quality and failure testing;
- human oversight and escalation;
- role-based AI literacy;
- incident log and regular review.
04
A practical 30-day plan
Week one: collect use cases and owners. Next, stop the highest-risk uncontrolled uses and create short assessment cards for the rest.
Weeks three and four: define rules, training, procurement and minimum supplier requirements. Align the longer roadmap with current AI Act exceptions, dates and legal changes.
SOURCES
Verified source material
Information was checked on the publication date. Legal obligations should always be assessed for the specific organisation and use case.