Governance starts by knowing which AI systems the organisation uses, why and with whose data. A list of tools is useful only if it also records owners, providers, affected processes and permitted actions.
Know which systems are in use
Include purchased services, internal integrations and experimental tools that handle work data. Record their purpose, users, data, provider, deployment location and connections. This reveals unreviewed uses and duplicate systems before a formal policy tries to cover them.
Obligations depend on the context
The EU AI Act uses a risk-based framework and distinguishes providers from deployers. Assess each system’s intended use and the organisation’s role with legal and data-protection specialists. The European Commission’s framework page is a starting point; check the current provisions and timetable for the actual use. Sources checked on 29 September 2026.
Define who reviews and who decides
Name a process owner, a technical owner and the people who can approve, stop or roll back a use. Write down permitted inputs, human review points, incident routes and how staff report an unexpected result. A nominal reviewer without evidence or authority cannot exercise meaningful oversight.
Review throughout the lifecycle
Reassess when the model, provider, data, tools or intended use changes. Keep test cases, access checks and a record of significant incidents. Decide when to retire a system and how to remove its credentials and retained data. The AI governance service can help organise these technical controls.
From knowledge to a working process
Assign responsibility before scaling AI.
We can help inventory uses, document controls and organise technical evaluation with your legal and data-protection teams.
Discuss AI governance ↗Sources and references
- European Commission: AI regulatory framework · Checked:
- EUR-Lex: Regulation (EU) 2024/1689 (AI Act) · Checked:
