CH
PL
The seven questions
1. Which AI systems are in use here – including the ones nobody officially introduced?
The inventory is the start of everything and regularly takes longer than planned. Not because of the technology, but because the honest answer is rarely in IT's tool list. Record per system: purpose, owner, categories of data processed, provider and where it runs. Nothing more is needed at the start.
2. Which risk class does the planned use case fall into?
The AI Act differentiates by risk, not by technology. Most mid-market use cases – document analysis, internal knowledge assistants, drafting – are not high-risk. It becomes sensitive where systems assess people or decide on access. Every pilot needs a deliberate classification, and the result should be written down.
3. Which data goes in, and where does it sit afterwards?
In practice, this question decides feasibility more often than any other. Three levels matter: which categories of data flow into the system, where they are processed and stored, and whether they are used for training. For companies handling confidential client, HR or project data, this is where the architecture question arrives – better before the pilot than after the first incident.
4. Who reviews an output before it reaches the customer?
Human oversight is not a formality; it is the single most effective measure available. But it has to be named: who reviews, how do they recognise a poor result, and what happens then? The hard case is not the obviously wrong answer. It is the convincingly worded wrong answer.
5. What do we document, and for whom?
Even outside the high-risk category, lean documentation pays off: purpose, data sources, review steps, known limitations, changes. Two pages per use case is enough to begin with. The audience is rarely a regulator. It is customers, public sector clients and increasingly tender documents.
6. Do the people using the system know how they are meant to use it?
Since February 2025, the AI Act has required measures supporting AI literacy. The Digital Omnibus softened this: it is framed as an obligation of means and expressly does not require guaranteeing a particular level of competence in any individual. Regardless of the legal framing, the practical core remains: most errors come not from the model but from unclear expectations of the model.
7. When do we look at this again?
AI systems change without you doing anything: models are updated, features added, providers switch subcontractors. A review date – twice a year is usually enough – stops a use case you once assessed from quietly becoming a different one.
A realistic sequence
First the inventory, because without an overview every further decision is a guess. Then the data question for the two or three most important use cases, because it determines architecture. Then the approval processes, because they take effect immediately. And only then documentation, which by that point is easier. Reverse that order, and you will usually document the state you wish you had rather than the one you have.
Governance is not a brake
These seven questions make sense regardless of any regulation. A company that knows which systems are in use, which data goes in and who owns the outputs can deploy AI faster and more confidently than one that does not. The postponement of the high-risk deadlines is therefore not an invitation to wait. It is a window in which these questions can be answered without deadline pressure.
Want to know where your company stands on these seven questions? We run a compact AI readiness check – write to sales@suppliance.at.
This article is editorial context, not legal advice. The applicable version of the AI Act and, where relevant, professional advice govern the assessment of your own use case.