Your step-by-step plan to the EU AI Act
For the manager or person responsible within the organisation. Work through these steps to put your AI use in order and give substance to the EU AI Act. Tick each step as you arrange it.
Map your AI use
Inventory which tools and systems use AI, where in your organisation and by whom. You cannot arrange what you do not have in view.
Determine the risk class per use
The AI Act is risk-based: banned, high, limited or minimal risk. Determine which category applies per system; the obligations follow from that.
Arrange AI literacy (Article 4)
Make sure employees, management and processes understand enough about AI to use it safely and consciously. This has been mandatory since 2 February 2025. The free AI course by Ubert Digital is the low-threshold start for this.
Set an AI policy
Record agreements about responsible AI use in a document or staff handbook: what is and is not allowed, with which tools and with which data.
Be transparent about AI
Make clear when and how you use AI, towards customers, employees and those involved.
Protect personal data (GDPR)
Make sure AI does not process personal data unlawfully, and align this with your privacy policy.
Set up human oversight
Let people check the outcomes of AI for decisions that really matter.
Document and keep evidence
Record which measures you take: inventory, policy and training. Under supervision you must be able to show it is in order.
Keep it up to date
Legislation, timelines and tools change. Review your policy and your people’s knowledge periodically.
Have it legally secured
Article 4 is one part of your compliance. For the full picture you work together with Open Legal, possibly even with a subsidy.
Open Legal secures the whole picture
Open Legal helps you secure your full AI compliance legally: from policy and documentation to the right agreements. And a subsidy may be available to (partly) fund this. Ask about it during your intake.
This learning sheet is a practical aid, not legal advice. It helps you give substance to measures around AI literacy (Art. 4 EU AI Act) and does not by itself make your organisation fully AI Act compliant.