Map the actual use
Record the tool, provider, users and intended outcome. A writing assistant and a system for assessing job applicants raise different questions. The AI Act framework distinguishes risks and roles; assessment starts with the actual function.
Check the data going in
Identify personal data, client information, confidential documents and third-party material. Review who can access it, whether the provider uses content for training, and available retention or deletion settings. Data protection requires a separate assessment.
Read beyond the subscription price
Usage rights, confidentiality, subcontractors, liability, service changes and exit terms affect everyday operation. Keep the applicable terms and identify which provider commitments need confirmation.
Set responsibilities and review points
Decide who approves use, what must not be entered and when human review is required. Information to affected people and the business’s obligations need use-specific assessment. Revisit the process when functionality, data or the legal framework changes.
YOUR STARTING POINT
Your file at a glance
- A short description of each use and the people it affects.
- An inventory of tools, providers and contractual terms.
- Data categories and access or retention settings.
- An owner for each use, human review and a way to report problems.
Sources & further information
General information informed by the sources above. It does not replace review of your specific documents and circumstances.