AI Governance and Regulation Readiness: Map Your Duties and Close the Gaps
Build an AI inventory, verify which duties apply, and assign owners to the gaps.
Build a first inventory of your company’s AI use, identify questions about scope and responsibilities, and assign the next checks. Turn the findings into a 30-day plan your team can maintain.
About this RisePlan
Course thesis
The AI Act applies in stages. Check which obligations apply to each AI use and to your company’s role, then record the source, relevant date, owner, and open questions. Use that assessment to plan the work your team needs to complete.
What you leave with
Create a first AI-use inventory, record your company’s role and open classification questions, and build a 30-day plan with sources, owners, and review dates. Flag uncertain legal conclusions for qualified review.
For
Founders, operations leads and reviewers at smaller companies using or developing AI for the EU, who need an inventory, evidence record and practical action plan.
Workflow
Company-wide review, assessment, and early implementation of EU AI Act compliance—starting from scope and risk mapping, to documentation gap analysis, to a first compliance sprint, tailored for small and mid-sized teams.
Change
Delivers a shift from ignoring or deferring AI regulation to proactive, confident action—mapping risk, closing the real compliance gaps, and building a lightweight ongoing routine.
What you can do
Use these as checks while you move through the plan.
Prepare the facts needed to review scope and responsibilities for each AI use.
Record classifications with current sources, company roles and unresolved questions.
Compare confirmed duties with existing evidence and identify gaps.
Assign a 30-day work plan with owners, dates and completion evidence.
Set an ongoing review routine that responds to relevant changes.
Wake-Up Call: Does the EU AI Act Apply to You?
Build an AI-use inventory and an initial scope worksheet with sources, company roles and open questions for review.
Start with the AI uses your company can identify: products, internal tools, vendor features and planned pilots. Record what each system does, who uses it, where outputs are used, and whether your company supplies, modifies or operates it.
Attach product records, supplier information and the responsible person. Ask a qualified reviewer to assess scope using the current rules; keep the reasoning and any exception with the record. A company-wide yes/no answer can hide differences between uses.
Check company size using current staff and financial information, including relevant group relationships. The Commission’s SME definition uses headcount plus turnover or balance-sheet criteria; group data may also count. Do not confirm SME status from staff numbers alone. Record missing facts, an owner and a due date.
Quality checklist
All AI uses, vendor tools, and internal deployments listed—not just flagship products.
EU market connection clearly marked.
SME/SMC criteria checked against real company data.
Gaps flagged with an assigned owner for any unclear field.
Status summary gives a clear, plain-language view of what action is needed next.
File is dated and shareable for audit or board review.
Common mistakes
Leaving out internal or experimental AI tools.
Assuming 'we’re just a user of X' means out of scope.
Not updating SME/SMC status with real, current data.
Letting ambiguous fields linger without flagging or ownership assigned.
Treating the worksheet as a legal memo instead of a decision map for operations.
Exercise
Pin Down Your Scope: Complete Your EU AI Act Company Status Worksheet
- Copy the worksheet and list the company’s AI uses, suppliers, locations and responsible people.
- Attach evidence for the function and company role of each use. Check company-size data and relevant ownership relationships.
- Mark uncertain facts and legal assessments as unresolved. Assign an owner and review date.
- Write a short initial status summary distinguishing recorded facts from conclusions awaiting qualified review.
- Save a dated version and send it to the responsible reviewer. Update the conclusions after review.
Use this at work tomorrow
Take 15 minutes: Fill the worksheet for a single product or your whole company, share with one other decision-maker, and book a follow-up on any flagged gaps.
Risk Mapping: Classify Every AI Use in Your Stack
Prepare a classification record for each AI use. Link the relevant provision, company role and reasoning, then route uncertain conclusions for review.
Scope, company role and obligations are separate questions. For each AI use, first establish what the system does and who is affected. Then check the current provisions for prohibited practices, high-risk uses and any transparency duties. Do not use “minimal risk” as proof that the Act is irrelevant.
For transparency, the Commission’s guidance distinguishes provider duties for interactive systems and content marking from deployer duties involving deepfakes, certain public-interest text, and other specified uses. Article 50 applies from 2 August 2026. Check the precise condition and exception for your use; there is no blanket December deadline for marketing.
Attach the current provision, source date, reasoning and reviewer to each conclusion. Keep unverified classifications pending. The Commission’s current transparency guidance is linked below; older Explorer pages may warn that amendments are not yet incorporated.
Quality checklist
Every material AI system/use is listed. No hidden in-house, vendor, or pilot projects skipped.
Risk class uses up-to-date Act definitions. No wishful thinking or handwaves.
Rationale applies Act language—or names the nearest legal category.
Unclear cases are flagged, with owners for follow-up.
Map is reviewed by someone who can defend it to board or regulator.
Common mistakes
Missing internal uses or vendor-powered AI tools.
Assigning ‘minimal risk’ without evidence or Act reference.
No one checks or challenges the map—leaving gaps.
Rationale is vague or uses only generic descriptions (e.g., 'low risk because it’s internal').
Failure to update after new AI uses roll out.
Exercise
Build Your Company AI Use Risk Classification Map
Use 15 minutes for the initial inventory; allow time for legal review.
- List active and planned AI uses, including internal tools, suppliers and pilots.
- Record each function, affected people and company role.
- Assess scope, prohibited-use, high-risk and transparency questions separately. Record the actual provision and source date; never leave “Article X” as a citation.
- Explain each initial conclusion. Keep missing facts or uncertain legal interpretations pending with an owner.
- Have a qualified reviewer check the record. Save their conclusion, reasoning and remaining questions before calling the classification complete.
Use this at work tomorrow
Run a 15-minute mapping session: get every team to list their AI-powered tools and uses, draft your first company-wide risk map (even if rough), and schedule a cross-check this week.
Gap Check: What Documentation Are You Missing?
Compare confirmed duties with existing records. Assign each gap an owner, evidence requirement and due date; keep uncertain applicability visible.
Build the gap list from the reviewed classification record. For each duty, record the company role, current provision, application date and evidence needed. Keep disputed applicability open until reviewed.
Technical documentation and deployer obligations have different provisions. Article 11 addresses high-risk technical documentation; Article 26 addresses high-risk deployers. Use the current text for your role. Do not prescribe one documentation package for every AI use or assume a company-size simplification removes a duty.
As checked on 8 September 2026, the Commission lists general application from 2 August 2026 and separate high-risk dates: 2 December 2027 for Annex III systems and 2 August 2028 for regulated-product systems. Check transitions for the actual use before assigning a legal deadline.
For each confirmed duty, inspect the available record and mark it checked, incomplete or missing. Mark unresolved applicability separately. Give each confirmed gap an owner, evidence of completion and a due date.
Quality checklist
Each use has a company role and a current, reviewed basis for the duty.
Existing records and missing evidence are distinguished from unresolved applicability.
Any exception or simplification has a specific source and reviewer.
Each gap has a named owner, due date and evidence needed to close it.
Common mistakes
Leaving out internal or vendor AI, only tracking customer-facing products.
Treating generic IT policies/documents as enough for technical documentation.
Assuming SME status removes a duty without checking the specific current provision.
Failing to assign a real, accountable owner and deadline to each gap.
Letting checklist languish in someone's folder with no update date.
Exercise
Draft Your Documentation Gap Checklist (SMB, Actual Use-Cases, Real Gaps)
- Bring the classification record and its open questions.
- For each confirmed duty, record the company role, current provision, application date and evidence required. Verify any size-based simplification before using it.
- Inspect available records. Mark each checked, incomplete, missing or applicability unresolved. Explain any “not required” conclusion with a source.
- Assign each gap or open question a named owner and due date. Keep legal deadlines separate from internal sprint targets.
- Set the next review and ask the responsible reviewer to check the checklist.
Use this at work tomorrow
Run your company's first AI documentation gap check—name owners, give every gap a date, and skip the legalese.
The 30-Day Plan: Your First Lightweight Compliance Sprint
Turn your intention into a real, finished sprint—assign owners, set the clock, and check off the first wave of compliance steps. Your plan must be visible, doable, and not disappear in the next busy week.
Plan the confirmed gaps as a 30-day sprint. Give each task a named owner, due date and evidence needed to close it. Assign unresolved legal questions to a reviewer.
Keep applicable legal deadlines separate from internal targets. At Day 15, inspect evidence and blockers; at Day 30, record completed work and carry unfinished items forward with owners. Escalate an identified missed legal deadline immediately.
Share one current plan with leadership and the people doing the work. A completed sprint records progress; it does not by itself establish compliance.
Quality checklist
Clear, real tasks—no vague or generic points
Owner named for each item—no ambiguity
All dates inside a real 30-day window
Both midpoint and end reviews scheduled
Plan shared outside your personal inbox—visible to team or leadership
All known blockers or risks surfaced in comments section
Common mistakes
Assigning tasks to functions or teams—not names
Letting 30 days slip by without a check-in
Leaving unfinished tasks out of the next plan
Not sharing the sprint plan, keeping it private
Writing unclear or wishful tasks ("sort out docs")
Exercise
Build, Assign, and Launch Your 30-Day Compliance Sprint
Your goal: a single-page, visible 30-day compliance sprint plan with owners, due dates, and check-ins. Use the template—real names, not roles. Minimum three items. Schedule your first review before closing this exercise.
Steps:
- List at least three real documentation/control gaps from your last checklist.
- For each, estimate work needed and name the real owner (with backup if out).
- Pick start date, midpoint check-in, and end-of-sprint review date (within 30 days).
- Share the plan with your company lead, founder, or board contact.
- Write the plan in the structure below. The plan isn't finished until it's visible and a review is scheduled.
Plan Submission Template
- Sprint title & dates
- Assigned items (gap, owner, estimate)
- Midpoint check-in date
- End-of-sprint review date
- Share-out method (where, who)
- Comments/next steps (space for blockers)
Action: Post/schedule this output to your wider team before moving on.
Use this at work tomorrow
Fill in your sprint plan, assign each gap, and schedule your first review by end of day—no delay, no hiding.
Keep It Up: Building an Ongoing, Low-Burden Compliance Routine
Sustain EU AI Act readiness by embedding a lightweight compliance routine, mapped to your business’s reality. Build in calendar check-ins, real owners, and alert systems for regulatory change—so you never drift back into exposure.
Give the ongoing review a named owner and backup. Keep the classification map, gap checklist and log of changed AI uses together.
Set a cadence your team can maintain and enter the next two dates. Review sooner after relevant rule changes, changes to a system or vendor, or a discovered missed obligation. Routine dates do not postpone legal deadlines.
Use an official regulatory source and record what changed, which uses it affects, and the next action. At each review, update evidence, open questions, owners and due dates. Record sign-off only when it happens.
Quality checklist
Every field in the template is filled with specific, real assignments—not placeholder names or vague dates.
Check-in cadence is feasible (at least annual), with next dates set on a live calendar.
At least one reliable regulatory monitoring channel is named, with a real person assigned.
Documentation review list covers all key compliance docs and new AI uses.
Steps are concise, numbered or bulleted, clear enough for a new joiner to understand and execute without confusion.
Plan is sent/shared with all relevant owners/leaders, not filed away.
Common mistakes
Only writing the routine—never setting the calendar event.
Leaving the owner unassigned or vague; using just 'Ops' or 'Legal'.
No regulatory update source picked; nobody tracking changes.
Routine is overly complex—impossible to run without a compliance desk.
Failing to include review of new AI systems or process shifts since last check-in.
Exercise
Build Your Company's Compliance Routine & Checkpoint Calendar
Your Task (15 Minutes)
Set up a live, low-burden compliance routine that fits your company size and AI risk. Complete the below steps and ready it for action.
Steps:
- Decide your check-in schedule: Annual (minimum), biannual, or quarterly? Mark the next two on your company calendar.
- Assign an owner: Name the main person responsible (plus a backup/secondary for absence/turnover).
- List documentation to review/update: Include your gap checklist, risk map, and any new AI uses.
- Choose a regulatory update channel: Identify a news source or tool (newsletter, alert, or RSS) and assign who monitors it.
- Set the update routine: Write short steps for what happens at each check-in (document update, owner report, board memo/minute, new risks logged).
- Finalize calendar invites: Create recurring events; link to this routine; copy the owner and backup.
Fill out the template. Save and circulate to all relevant owners and leadership.
Use this at work tomorrow
Set your first compliance checkpoint date, assign a real owner, and subscribe to an AI regulatory update channel—before today ends.
30-day path
Day 1-3: Complete company scope worksheet and risk classification map.
Day 4-6: Run documentation gap check and assign owners for missing items.
Day 7: Hold a kickoff review with founders/board; agree on the 30-day sprint.
Weeks 2-4: Execute sprint: fill documentation gaps, implement priority controls, run first check-ins.
Day 30: Hold a close-out review, update compliance routine template, and calendar next periodic review.
Success signals
Company has a completed risk classification map, reviewed by at least one C-level or board member.
AI Act documentation gap checklist is filled, prioritized, and assigned to responsible owners.
30-day compliance sprint is planned, scheduled, and tracked—in writing.
First sprint results in documented controls, policies, and traceable progress.
Compliance routine and next review date are scheduled; board/leadership sign-off recorded.
Reflection prompts
Where does this topic show up in real work?
What behavior should change first?
What evidence would prove this Riseplan worked?
Manager checklist
Choose one owner for the behavior change.
Use the exercise on live work.
Review the output before scaling the habit.
Decide what changes after 30 days.
Want this shaped around your company?
Risey can research your company foundation first, then build a version of this path around your real workflows, customers, and culture.
Start with your company