Questions for the board

What we use

Do we have one complete list of every AI system in use, including the tools staff chose themselves and the models inside software we buy?
A good answer: One register naming each system's owner, supplier, data and purpose. DORA, Article 28(3), for financial entities since 17 January 2025.
For each system, are we its provider or its deployer, and could a change we make turn us into the provider?
A good answer: A role per system in writing, checked before any change that could make us the provider. EU AI Act, Article 25, from 2 December 2027 for the uses in Annex III.
Which of our uses does Annex III list as high risk, and what is our plan for 2 December 2027?
A good answer: A written classification per use with its reasons, and a dated plan with an owner. EU AI Act, Annex III and Article 113: the high-risk duties apply from 2 December 2027.

For each type of work, where is our data processed: anywhere in the world, in a European region, or on our own premises?
A good answer: A route per type of work, with the deployment type named in the contract. GDPR, Articles 44 to 49, on transfers to a third country.
What does each provider keep of what we send, for how long, and may it use our data to train models?
A good answer: The retention period, its exceptions and the terms on training, as the contract states them. GDPR, Article 5: personal data is not kept longer than needed.
If we run a model on our own premises, which duties remain with us?
A good answer: Every duty except those on transfers and outside processors; no location makes an organisation compliant by itself. GDPR, Article 32; under the EU AI Act the duties follow the role, not the place.

Which board member is accountable for our use of AI, and how does the board keep its own knowledge up to date?
A good answer: A name in a board decision, and a record of the training the board itself followed. DORA, Article 5(2)(a), for financial entities; NIS2, Article 20, through national law.
Who may overrule each system, and do those persons have the competence, the training and the authority to do it?
A good answer: Named persons per system who can stop it or set its outcome aside. EU AI Act, Article 26, for high-risk systems from 2 December 2027; GDPR, Article 22(1).
Do the staff who use these systems know enough to use them well, and can we show it?
A good answer: Measures per role, with a record of who followed what and when. EU AI Act, Article 4, since 2 February 2025: measures to support the AI literacy of staff.
Where a supplier runs a system for us, does the contract let us and our supervisor inspect it?
A good answer: Rights of access, inspection and audit in the contract; the responsibility stays with us. DORA, Article 28(1)(a) and Article 30(3)(e)(i), for financial entities.

Can we show that people who deal with one of our systems are told that it is an AI system?
A good answer: A list of every system people deal with directly, with the notice it shows. EU AI Act, Article 50(1), since 2 August 2026.
Can we show what each system did, and for how long do we keep its logs?
A good answer: Logs kept for a period that fits the purpose, at least six months for a high-risk system. EU AI Act, Article 26, for deployers of high-risk systems from 2 December 2027.
Did we evaluate each system on our own work before use, and do we monitor it in use?
A good answer: An evaluation on our own tasks before use, and monitoring with a named owner. EU AI Act, Article 26, for deployers of high-risk systems from 2 December 2027.
If a system fails or leaks personal data, who reports what to whom, and within what time?
A good answer: A written route with names and time limits, covering AI as well as other technology. GDPR, Article 33(1): a personal data breach is notified within 72 hours where feasible; EU AI Act, Article 26, from 2 December 2027.

This page is not legal advice. Rules and dates checked on 5 October 2026. The AI Guys, contact@theaiguys.com.