Playbooks
Prepare for the AI Act
List AI systems, classify them, follow the obligations shown, write the impact assessment and get it approved.
Role: Compliance manager Role: Approver This playbook organizes the inventory of AI systems under Regulation (EU) 2024/1689.
Warning
A classification result is an aid to inventory, not legal advice. The obligations shown are short labels, not the text of the law. Confirm with your counsel.
1. Turn the framework on
Screen: Frameworks. Turn on Regulation (EU) 2024/1689 if you want it to count in the score.
2. List the systems
Screen: AI governance. "Add an AI system": name, purpose, provider (see Vendors), role ("Provider", "Deployer", "Importer", "Distributor"), data processed, owner.
3. Classify
Answer the questionnaire, one question at a time (Article 5, Annex I, Annex III, Article 50). The result — prohibited (Article 5), high risk, transparency or minimal risk — is saved with its reasons in the record and in the audit log.
4. Follow obligations and write the impact assessment
- The obligations list says what to follow, not that it is done.
- The impact assessment has eight sections; submit it to a named approver.
5. Get it approved
Role: Approver Statuses: draft, in review, approved, retired. An unclassified or prohibited system cannot be approved. The author of an assessment does not approve it; neither does the system owner. Only an administrator can override, and the gap is recorded.
6. When the system changes
Changing the role, purpose, provider or data of an approved system sends it back to review; if the category changes, redo the impact assessment and approve again.
What the app does not do
- It does not make a system compliant and never says it is.
- It does not say you are subject to a given obligation.
- A reclassification that changes answers without changing the category leaves the system approved: re-read it.
Was this page helpful?