Checklist: Responsible AI and compliance (AI Act)

You can only govern what you have made visible.

• Every use of AI in the company is on record (tools, teams, purposes).
• For each use case, the data involved is identified.
• Someone is accountable for each use case.
• “Shadow” uses (AI used without approval) are tracked down.

The AI Act scales the obligations to the risk of each use case.

• High risk uses (HR, scoring, access to entitlements) are identified.
• Prohibited uses (social scoring, manipulation) are ruled out.
• The risk level sets the level of control applied.

Your customers and your teams should know when AI is involved.

• You say so when content or an answer is generated by AI.
• Chatbots clearly state that they are not human.
• AI assisted decisions can be explained.

AI proposes, people decide on what matters.

• A human sign-off exists on sensitive decisions.
• Critical AI answers are grounded in sources you can check.
• Hallucinations and errors are monitored and corrected.
• What AI agents are allowed to do is limited and supervised.

AI without guardrails leaks your data.

• No personal or confidential data is entered into consumer AI tools you do not control.
• AI use follows your privacy and data protection policy.
• Access to AI tools and to data is under control.
• How AI vendors keep and use your data has been checked.

The framework only holds if the teams carry it.

• An AI usage policy exists and is shared.
• Teams are trained on good practice and on the risks.
• Uses and incidents are logged.
• An AI lead keeps the subject alive over time.