An EU AI Act readiness playbook: seven steps to a defensible programme

The EU AI Act is not something you comply with in an afternoon, but it is also not the black hole it can look like from the outside. The trick is to stop treating it as one giant obligation and start treating it as a sequence of manageable ones. Here is the order we would run it in.

The seven steps

• Inventory your AI. You cannot govern what you have not listed. Find every model and AI feature, including the ones a team quietly adopted last quarter.
• Classify each by risk. Run every system against the Act's risk tiers. This single step tells you where the real obligations land and where you can relax.
• Confirm nothing is prohibited. Check your uses against the banned list first, because that is the fastest way to find a genuine problem.
• Meet the high-risk requirements where they apply: data governance, documentation, human oversight, accuracy and monitoring.
• Handle transparency duties. Make sure people know when they are interacting with AI, and that outputs are labelled where required.
• Stand up post-market monitoring and incident handling, because the obligations do not stop at launch.
• Document the whole thing so it is defensible. If you cannot show your reasoning, you cannot prove your compliance.

Ninety percent of EU AI Act readiness is knowing what AI you actually have and how risky each use is. Do that honestly and the rest is execution.

How Compliance One runs the play with you

The platform turns this sequence into a tracked programme rather than a heroic memo. The full control library is enabled by default with a promote-to-applicability model, so classification and scoping happen inside the tool. Documentation and evidence live with the controls, cross-mapped to ISO 42001 so you are not duplicating work. The seven steps stop being a wish list and become a status you can watch move from red to green, which is a much better thing to show a regulator than good intentions.