Sources checked: 7 September 2026
Use the process as the unit
The same tool may do different things across departments. Use intended purpose as the organising principle. A process record identifies the owner, supplier, data, human review and cost. Keep unknown fields visible; an empty field does not establish low risk.
Four questions for the review
What changed? Which checks were performed? Which actions remain open? Is the application still useful? Ask the owner for evidence that answers those questions. This could be an updated instruction, a summary quality check or a recorded decision.
Avoid a misleading score
A percentage of completed fields measures record coverage, not legal compliance. Distinguish missing information, assessed risks, accepted exceptions and completed checks. Show management which decision is needed and who is preparing it.
A small but usable evidence pack
Connect the process record to approved policy, the supplier assessment, relevant instructions and open actions. Record dates and versions for evidence. Keep only what is needed and restrict access. A new owner should be able to understand the file without reading every old email.
Quarterly is a working rhythm
We suggest a quarterly review as a practical starting point, not a universal statutory frequency. An incident or major change may require an earlier discussion. AI Act obligations and dates vary by application. A specific review may conclude with continuing, adapting, investigating or stopping.
What you can use it for
A decision log with action owners, deadlines, evidence references and the next review point.
This guide provides general information. Assessment of a specific application depends on your role, data and intended use.
Sources and further reading
This article was prepared with AI assistance and checked against our editorial and sourcing guidelines.