I assess the actual use case before the model. An internal assistant, recruitment tool, and biometric system can create very different obligations even when they use similar technology.
I use this readiness workflow with a qualified reviewer. Obligations depend on role, use, jurisdiction, exceptions, and current legislation; the templates do not establish legal compliance.
Before I start
- An inventory of AI tools, vendors, intended uses, users, and affected people.
- A business owner, security/privacy contacts, and a qualified legal/compliance reviewer.
- Vendor documentation and a place to record role, classification, controls, and evidence.
Step by step
Create an AI use register
I record one row per intended use: owner, supplier/model, data categories, audience, decisions influenced, countries, and whether the system acts automatically. I include pilots and embedded AI features, not just the tools procured by IT.
Determine our role for each use
Document whether the organisation is a deployer, provider, importer, distributor, or another relevant actor. Rebranding, substantial modification, or changing intended purpose may affect the role; I escalate that decision rather than assuming ordinary customer status.
European Commission: AI Act FAQ and current dates · EUR-Lex: AI Act legal text and current-version access
Check prohibited and high-risk use
I screen intended use against the current prohibited practices and high-risk rules, including relevant exceptions. Employment, education, essential services, and certain biometric uses deserve particular review. I do not use a generic “low risk” tick to bypass classification.
European Commission: AI Act FAQ and current dates · EUR-Lex: AI Act legal text and current-version access
Record the current applicability dates
As checked on 13 October 2026, Commission guidance lists AI-literacy/prohibition provisions from 2 February 2025, GPAI obligations from 2 August 2025, and general/transparency rules from 2 August 2026. It lists high-risk dates of 2 December 2027 and product-embedded high-risk dates of 2 August 2028 following the 2026 Omnibus changes. I verify the applicable amended legal text before relying on a deadline.
Train the people who use and oversee AI
I create role-appropriate AI literacy training covering capabilities, limitations, sensitive data, human review, and reporting failures. I keep the audience, materials, attendance, and practical exercise results.
Apply transparency and oversight controls
I review relevant Article 50 duties: notice of AI interaction, output marking or disclosure where applicable, and the use-specific exceptions. I define who reviews consequential outputs and how a person can challenge or escalate a result. I also assess GDPR and sector rules separately.
European Commission: AI Act FAQ and current dates · EUR-Lex: AI Act legal text and current-version access
Gather vendor and implementation evidence
I request intended-use documentation, limitations, data/security terms, instructions, testing, and applicable conformity information. I log unresolved gaps rather than claiming a vendor certificate covers every customer use. The AI register links to this evidence and its reviewer.
Decide and review before rollout
I approve the use case only after the reviewer records role, classification, applicable obligations, controls, and open risks. I retest after a model, vendor, audience, or purpose change and retain a versioned decision record.
How I check the result
0 of 4 checks completed
Checklist progress stays in this browser. I use it to track checks, not to certify a deployment or compliance.
If something does not work
The vendor says “AI Act compliant”
Ask which role, system, obligations, evidence, and version the claim covers.
A use changes from drafting to making decisions
Reassess intended purpose, affected people, risk category, and oversight before rollout.
A deadline is copied from an old article
Check current Commission guidance and the amended official legal text.
My working templates
I document the use, role, classification decision, and evidence for every AI system.
Download CSV ↓I adapt the scope, approval rules, oversight, and escalation route before approval.
Download MD ↓I record expected answers, permission checks, failures, and evidence before release.
Download CSV ↓Official sources I checked
I checked these sources on 13 October 2026. Product screens and legal requirements change; I verify the relevant source before a production rollout or legal decision.