Confirm the basis for the programme.
Start with the system's intended purpose and the recorded classification rationale. Identify the relevant provider, deployer and other supply-chain parties, then establish which activities and evidence sit with each. A supplier's assurance pack may inform this work but does not explain your complete deployment.
Keep the applicable dates and any product-specific requirements attached to the programme. The linked guide explains the current high-risk framework and directs reviewers to official sources.
Connect requirements to work people can perform.
Break the programme into manageable decisions: what evidence supports the system's purpose, how limitations are communicated, what data questions need resolving, how human review operates and which monitoring information will be collected. Assign a responsible person to each work item and an appropriate reviewer to its completion.
Do not mark a control complete because a document exists. Identify what the document demonstrates, whether it concerns the current release and which questions remain open.
Prepare a coherent system record.
A useful record links assessments, evaluations, technical references, instructions, approvals and unresolved issues. It should explain the boundaries of the approved use and help the next reviewer understand why a decision was made.
- A system and role map with named accountable parties.
- A requirements-to-evidence index.
- Documented oversight and monitoring responsibilities.
- Open actions, release conditions and reassessment triggers.
Plan formal review and continued operation.
Where a conformity procedure or specialist assessment is required, identify the route, evidence owners and dependencies early. EUAIC can help organise the preparation and action tracking; it is not a notified body and does not issue regulatory approval.
After the initial decision, maintain the record through supplier changes, incidents and expanded uses. A programme should make it clear who may authorise a change and which earlier assumptions must be reviewed before the new use proceeds.