the whole job
AI Act: the whole job, in order
If your staff use AI tools at work, you are probably a deployer, and some AI Act duties already apply to you. Here is the job as a plan: seven phases, in the order that holds up, with who carries each step, what it produces and the proof it leaves.
how to read this plan
Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, lists and settings that someone builds, and checks that someone keeps running. The first five phases apply to every company that uses AI tools. The people phase applies if you use AI on applicants or staff, and its duties start on 2 December 2027, after the July 2026 change. Under each step a small note names the legal basis, or says practice where no text sets it. Practice is still worth doing, and the difference tells you what a regulator could ask for.
- decide and documentchoices, policies and records that someone with authority signs
- build and configuresystems, settings and procedures that make the choice real
- prove and operatechecks, logs and records that show it keeps working
settle who answers
Confirm that you are a deployer, name an owner and put the dates in one calendar.
confirm that you are a deployer
A deployer is a company that uses an AI system under its own authority, outside personal use. Check whether staff use any AI system for work. If the answer is no, write that down and check again once a year.
- owner legal or DPO
- decide and document
- what it produces
- a one-page note with the date and the reasoning
- the proof it leaves
- the note, approved by management
basis AI Act Art. 2(1), 3(4)
name an owner for AI use
Pick one person who answers for which AI tools the company uses and for what. Give that person the authority to say no, and decide who reports to the board on how the work is going.
- owner board
- decide and document
- what it produces
- a board decision naming an accountable owner
- the proof it leaves
- the minutes of that decision
basis working practice. No legal text sets this.
put the dates in one calendar
Record the dates that touch a deployer: the bans and the literacy duty already apply, 2 December 2026 adds two bans, and 2 December 2027 starts the high-risk rules for the uses listed in annex III. Rules in this area have moved before, so note the day you checked.
- owner legal or DPO
- decide and document
- what it produces
- a dated list of the dates that apply to you, with the source of each
- the proof it leaves
- the list, rechecked on a stated date
basis AI Act Art. 113; Regulation 2026/1744 Art. 1
see what you use
List every AI tool in use, what it is used for and whether it touches people or personal data.
list every AI tool in use
Start from what you can export today: the software list from finance, the app list from your identity provider, the browser extensions on managed devices. Then ask each team which tools they use, including free ones and ones built into other software.
- owner head of IT
- build and configure
- what it produces
- an inventory of AI tools with an owner each
- the proof it leaves
- dated exports and the inventory
basis working practice. No legal text sets this.
record purpose, data and users for each tool
Next to each tool, write what it is used for, what data goes in, who uses it and whether its output reaches customers, applicants or staff. Mark every tool used to screen applicants or evaluate staff.
- owner everyone
- build and configure
- what it produces
- an inventory with purpose, data and users per tool
- the proof it leaves
- the inventory, confirmed by each team lead
basis working practice. No legal text sets this.
write the rules and train people
Agree which tools are allowed, for what, and train the staff who use them.
write the rules for staff
Decide which tools are allowed, what data may go into them, who approves a new tool and who staff ask when unsure. Say which results a person must check before they are used. Keep it to a page.
- owner board
- decide and document
- what it produces
- a one-page AI use rule, signed by management
- the proof it leaves
- the rule, with the date of approval and the version
basis working practice. No legal text sets this.
run AI literacy training on the tools you use
The duty is to take measures that support AI literacy of the staff who use these systems. The July 2026 text does not ask you to guarantee a set level for each person. A short session on your own tools and your own rules is a reasonable measure. Cover new joiners too, and keep the attendance list with the material.
- owner HR
- build and configure
- what it produces
- a training session and an attendance record
- the proof it leaves
- the record and the material with its version
the work pagethe control: awareness-training
basis AI Act Art. 4; Regulation 2026/1744 Art. 1
check the red lines
Check your tools against the banned practices and the transparency duties, and find out whether any use is high-risk.
check your tools against the banned practices
Go through the list of banned practices once, tool by tool, and write down the result. Two bans start on 2 December 2026: AI that generates sexualised images of identifiable people without their consent, and AI that generates child sexual abuse material. Stop any use that falls under a ban.
- owner legal or DPO
- prove and operate
- what it produces
- a dated check of each tool against the list of bans
- the proof it leaves
- the check, signed by its author
basis AI Act Art. 5
tell people where transparency applies
If you publish deep fakes, say so. If you use emotion recognition or biometric categorisation, tell the people it is used on. Find out from the inventory whether either applies, and if it does, write the notice.
- owner legal or DPO
- build and configure
- what it produces
- a list of uses that need a notice, and the notices
- the proof it leaves
- the notices as published or given
basis AI Act Art. 50(3), 50(4)
find out whether any use is high-risk
Compare each marked use with the annex III list. Tools that filter applications or evaluate staff are on it. If a use is on the list, the next phase applies to it. If you decide it is not, write the reasoning.
- owner legal or DPO
- decide and document
- what it produces
- a decision per marked use, with reasoning
- the proof it leaves
- the decisions, approved by the owner of AI use
basis AI Act Art. 26(1); AI Act Annex III
ask your suppliers
Put the right questions to every AI provider and keep the answers.
send the same questions to each AI provider
Ask each provider: Does it say whether the system is high-risk under annex III? Where are the instructions for use? Which logs can you export and for how long? How does it handle serious incidents and tell you? Is your data used to train the system? Does it mark generated content?
- owner procurement
- build and configure
- what it produces
- a standard AI questionnaire and the answers received
- the proof it leaves
- the questionnaire and the answers, dated
the work pagethe control: supplier-management
basis working practice. No legal text sets this.
put the answers into contracts and the register
Where a tool handles personal data for you, check whether the provider acts as a processor and whether the contract carries the required terms. Record each answer in the supplier register and add what you need, such as log access, to the contract at renewal.
- owner procurement
- build and configure
- what it produces
- an updated supplier register and a list of contract changes
- the proof it leaves
- the register, and the signed terms where they changed
the work pagethe control: supplier-management
basis GDPR Art. 28(3)
if you use AI on applicants or staff
Meet the deployer duties for high-risk uses before 2 December 2027.
decide whether the use stays
For each high-risk use, decide whether to keep it, replace it or stop it before the duties start on 2 December 2027. Compare the effort in the steps below with what the tool gives you.
- owner board
- decide and document
- what it produces
- a board decision per high-risk use
- the proof it leaves
- the minutes of that decision
basis AI Act Annex III
get the provider's instructions and follow them
Ask the provider for the instructions for use and keep the current version. Take measures to use the system as they say. If you cannot say what the instructions are today, finding out is the first job.
- owner procurement
- build and configure
- what it produces
- the provider's instructions on file, and a note of how you follow them
- the proof it leaves
- the instructions with their version and the date received
the work pagethe control: supplier-management
basis AI Act Art. 26(1)
give oversight to someone competent
Assign human oversight to a named person with the competence, training and authority to act, with authority to act on what the system does. Make sure that person has the time.
- owner board
- decide and document
- what it produces
- a named overseer for each high-risk use
- the proof it leaves
- the appointment, and the training the person received
basis AI Act Art. 26(2)
tell workers and their representatives first
Before you put a high-risk system into use at work, inform the workers affected and their representatives. Say which system, for what purpose and who to ask. Check whether your national law or an agreement adds consultation duties.
- owner HR
- build and configure
- what it produces
- a notice to workers and their representatives
- the proof it leaves
- the notice with the date it was given
basis AI Act Art. 26(7)
keep the logs you control
Find out which logs the system produces and which of them sit under your control. Keep those for at least six months, unless another law sets a different period. Agree with the provider how you get the rest.
- owner head of IT
- build and configure
- what it produces
- a log retention rule for each high-risk use
- the proof it leaves
- a sample export showing the retention in effect
the control: logging-monitoring
basis AI Act Art. 26(6)
monitor the system and report serious incidents
Monitor operation against the instructions. If you identify a serious incident, report it to the provider and to the authority. Add this route to your incident procedure and name who sends the report.
- owner head of IT
- build and configure
- what it produces
- a monitoring routine and a reporting route with named roles
- the proof it leaves
- the procedure, and a dry run of the report
the work pagethe control: incident-management
basis AI Act Art. 26(5)
keep personal data in these systems under GDPR
Applicant and staff data in these tools stays under GDPR. Add each tool to your risk assessment with the risk to the people concerned, and check the security measures fit that risk.
- owner legal or DPO
- build and configure
- what it produces
- each tool in the risk assessment with a security decision
- the proof it leaves
- the assessment, dated and approved
basis GDPR Art. 32(1)
show it keeps working
Keep the inventory current, keep the proof together and report to management.
keep the inventory current
Review the inventory on a set rhythm and whenever a team adopts a new tool. Compare it with the software list from finance, and ask about anything that shows up in one and not the other.
- owner head of IT
- prove and operate
- what it produces
- a review rhythm and a dated review record
- the proof it leaves
- the review records
basis working practice. No legal text sets this.
keep the proof in one place
Collect the outputs of every step above in one folder: the inventory, the rules, the training record, the banned-practice check, the notices, the instructions and the provider answers.
- owner head of IT
- prove and operate
- what it produces
- an evidence folder organised by step
- the proof it leaves
- the folder, with each item dated
basis working practice. No legal text sets this.
report to management and recheck the dates
Once a year, show management the list of tools, the open gaps and the dates ahead. Recheck the dates against the current text of the AI Act, because they were changed in July 2026. Record what management decided.
- owner board
- prove and operate
- what it produces
- a yearly report to the board
- the proof it leaves
- the report and the minutes
basis working practice. No legal text sets this.
who carries what
The same steps, grouped by the person who has to act.
legal or DPO
board
head of IT
controls you will need
Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.
check it yourself
your next step
List every AI tool in use at your company this week, including the ones nobody approved, and mark any used on applicants or staff.