List the tools and uses you already know.
Begin with the applications used for customer work, recruitment, finance, development and administration. Ask the people doing the work which AI features they rely on and where outputs go. Record an owner and purpose for each significant use, even when the initial list is short.
Keep the first collection exercise understandable. A concise use-case description often reveals more than a lengthy questionnaire completed without knowing why the questions matter.
Review the uses with the greatest consequences first.
Look for sensitive information, decisions affecting individuals, unclear supplier terms or outputs used without human review. Assign specific questions to someone who can answer them. Where specialist advice is needed, a clear factual record makes that conversation more productive.
A smaller organisation should not assume that size alone removes legal obligations. Equally, it should avoid treating every internal productivity tool as though it requires the same extensive assessment.
Make everyday instructions easy to follow.
Describe approved tools, acceptable inputs, required checks and the route for proposing a new use. Give staff a named contact and examples related to their work. Agree who can pause a use if something goes wrong and how the issue will be recorded.
- A concise inventory with named owners.
- Practical acceptable-use guidance.
- A small, prioritised evidence and action list.
- A review date and a route for reporting changes.
Choose a process you can keep current.
Start with the minimum structure needed to support real decisions, then add detail when the estate or responsibilities grow. Reuse reliable supplier and policy information while keeping the specific deployment context clear. Avoid collecting documents that no one has time or authority to review.
An EUAIC engagement can establish that starting structure and an agreed handover. Scope, pricing, integrations and support are confirmed through a proposal; this page does not promise a fixed package or automatic legal compliance.