Processes and procedures — AI Act readiness

Objective: a complete register of AI systems used in the organisation, with an assigned owner and description. Basis: EU AI Act 2024/1689 (operator roles, transparency).

1. Inventory — identify all AI systems and components (including chatbots, models embedded in third-party tools, automations).
2. System description — purpose, input/output data, provider, version, environment.
3. Owner designation — the person/unit responsible in substantive and organisational terms.
4. Register entry — a single AI systems register with an identifier, date and status.
5. Review cycle — set the frequency of entry updates and the triggers (new version, new risk).

GAP when: a system operates “in the shadows” without an entry, has no assigned owner, or is not versioned.

Objective: assign the system to a risk category under EU AI Act 2024/1689 and select the appropriate obligations.

1. Prohibition test — check whether the use case falls within prohibited practices (e.g. social scoring, manipulation, impermissible biometric identification). If so — STOP.
2. High-risk test — does the system affect decisions concerning persons (access to services, employment, benefits, law enforcement, critical infrastructure)? → high-risk.
3. Limited-risk test — does the system interact with a person or generate content (chatbot, deepfake)? → transparency obligation.
4. Remaining — a minimal-risk system: voluntary good practices.
5. Classification documentation — record the criterion, rationale and date; link to the register (proc. 1).

Criteria: the category follows from the use case, not from the technology. High-risk classification triggers obligations on risk management, data, logs and human oversight.

Objective: assessment of the impact on the rights and freedoms of persons. Basis: GDPR Art. 35 (DPIA) and the accountability principle.

1. Threshold test — may the processing result in high risk (profiling, evaluation, large-scale data, monitoring)? If so — a DPIA is required.
2. Description of operations — purpose, scope, context and nature of the processing, categories of data and persons.
3. Necessity and proportionality assessment — whether the AI is necessary and adequate to the purpose.
4. Risk identification — erroneous decision, discrimination, lack of explainability, data leakage.
5. Mitigation measures — technical and organisational (including human oversight — proc. 4).
6. Consultation and approval — involvement of the DPO; where necessary, consultation with the supervisory authority.

GAP when: there is no DPIA for a high-risk system, or a DPIA without identification of mitigation measures.

Objective: ensuring effective human control over the system. Basis: AI Act (human oversight), the Code of Administrative Procedure (KPA) (limiting the automation of rulings). More: /human-oversight.

1. Control points — designate the moments at which a person approves, corrects or rejects an output.
2. Approval gates — no action with legal effect occurs without the operator's approval.
3. Kill-switch — a mechanism for the immediate suspension of the system and the procedure for its use.
4. The claim ≤ proof rule — the system may not assert more than it demonstrates with evidence.
5. Operator competence — training and authorisation of the person exercising oversight.
6. Intervention register — a log of every approval, correction and stop (linked to proc. 5).

GAP when: a decision concerning a person is taken fully automatically without an approval gate or without a functioning kill-switch.

Objective: a complete, verifiable trail of the actions of the system and operators. Related: /audytowalnosc, /evidence-index.

1. Action logging — logs of inputs, outputs, model decisions and human interventions.
2. Versioning — versions of the model, data, prompts and configuration; linked to the event.
3. Integrity — protection of logs against modification (immutability, time stamps).
4. Retention — a retention period consistent with the GDPR and with AI Act requirements for high-risk systems.
5. Evidence indexing — proof-packs linked to the system in the evidence index.
6. Reproducibility — the ability to reconstruct how and on what basis a given output was reached.

GAP when: there are no logs, the logs are modifiable, or the output is not linked to the model/data version.

Objective: securing a person's right to an explanation and a pathway for contesting an output. Basis: GDPR (transparency, accountability), KPA, AI Act (transparency).

1. Right to an explanation — providing understandable information about the role of AI in a given output.
2. Appeal channel — a clear pathway for the person concerned to contest the output.
3. Human review — re-assessment under operator oversight (proc. 4).
4. Establishing responsibility — on the basis of the chain of evidence (proc. 5), without attributing fault without proof.
5. Case register — a record of appeals, rulings and lessons learned.
6. Feedback loop — the lessons feed system correction and the update of the risk assessment (proc. 3).

Rule: responsibility is established from evidence. No proof of fault = GAP, not a presumption of fault.