Establish the organisation and systems in scope.
Map the entities involved, markets served, intended uses and relevant supply-chain roles. A group may supply one AI-enabled service while using another internally. Keep those contexts separate so responsibilities are not assigned solely by department name or supplier branding.
Begin with available records and identify important gaps. An initial programme should explain what has been reviewed and what remains outside its current coverage.
Sequence work by decisions and dependencies.
Identify the questions that block progress: an unknown intended purpose, missing supplier information, uncertainty about affected people or a disputed role. Assign those questions before distributing a long checklist to teams that cannot yet answer it.
Create workstreams for classification, evidence, oversight, supplier review and monitoring where they are relevant. Prioritise work that requires several teams or an external supplier, since these dependencies often shape the realistic delivery sequence.
Give each action a useful completion condition.
An action should say what information or change is needed, who owns it and what evidence will demonstrate completion. 'Review AI compliance' is too broad to close responsibly. 'Confirm the approved purpose and obtain the supplier's current use limitations' gives an owner a specific result to deliver.
- An agreed inventory and scope statement.
- A role and responsibility map.
- A prioritised gap register with owners.
- Review checkpoints and evidence needed for decisions.
Keep the programme linked to current requirements.
AI Act application is phased, and the 2026 amendments changed important high-risk dates. Use the current official text and the linked guide when setting milestones. Existing privacy, employment, product and sector obligations may also require work on a different timetable.
EUAIC supports the organisation of readiness activity. Legal interpretation, formal conformity procedures and acceptance of residual risk need the appropriate accountable people. Completing a software workflow is not a certificate that the organisation or every system complies.