01
Prioritise visibility before documentation volume
Start with the AI systems that influence people, regulated decisions, critical operations, customer-facing content or confidential data. Record business purpose, owner, vendor, affected groups and whether the system is developed internally or acquired.
A concise, maintained inventory is more useful than a long policy disconnected from actual tools. It also supports procurement, security, privacy and contractual review.
02
Use vendors without outsourcing accountability
SMEs often rely on third-party models and software. Ask vendors for intended-purpose information, limitations, documentation, security commitments, change notices and the evidence needed to understand your own role and use.
Keep decisions about configuration, user access, human review and acceptable use under organisational control. A vendor statement can be evidence, but it does not replace context-specific assessment.
- Contract and documentation review
- Approved-use and access controls
- Human review for consequential outputs
- Change and incident notification routes
03
Build a small, repeatable governance loop
Assign one accountable coordinator and named business owners. Use a short classification record, practical policies, role-based AI literacy and a monthly or quarterly review of new systems and official changes.
The EU provides an official Single Information Platform, compliance checker and Service Desk. These resources can support internal assessment, while tailored legal advice remains appropriate for material or uncertain cases.