AI use inventory

Three questions so we only show the sections that apply to you. They are not scored.

1. Do you use AI that talks directly to customers, members or the public, or that creates images, audio, video or text you publish?
2. Do you use AI to help make decisions about people — such as screening job applicants, monitoring or evaluating staff, assessing eligibility for services, credit or insurance, or assessing students?
3. Do you build AI systems or AI features and offer them to others under your own name?

Article 4 of the AI Act has applied since 2 February 2025. Following the 2026 Digital Omnibus amendments, providers and deployers are expected to take measures to support the AI literacy of their staff and others using AI on their behalf. No specific level or certificate is required.

1. Have you taken steps to help staff and volunteers who use AI understand how it works, its limits and risks, and how to use it responsibly in their role? HR / Operations
2. When did you last run AI literacy training or a briefing? HR / Operations

From the help text

Measures should fit your context — people's existing knowledge, the tools they use and who is affected. 'Yes' means role-appropriate guidance or training for everyone who uses AI at work.

GDPR applies whenever personal data goes into an AI tool. The Data Protection Commission advises understanding what data you use, where it goes, and whether the vendor keeps or reuses it.

1. What kinds of information do people put into AI tools? Select all that apply. Data protection lead
2. For AI tools that handle personal or confidential data, have you checked the vendor terms — data processing agreement, whether your inputs are used for training, retention and where data is stored? Data protection lead / IT lead
3. Where AI processes personal data in a way likely to be high risk — for example about children or vulnerable people, or for decisions about individuals — have you carried out a data protection impact assessment (DPIA)? Data protection lead
4. Do people check AI outputs for accuracy before relying on them, especially anything sent to others or used to decide something about a person? Operations

From the help text

Personal or confidential data in consumer AI tools may be retained or used to train models. Approved business tools with proper terms are much safer.

The AI Act's transparency rules for chatbots and AI-generated content apply from 2 August 2026, with some grace for systems already on the market. They're about making sure people know when AI is involved.

Asked only if you answer “Yes” to: Do you use AI that talks directly to customers, members or the public, or that creates images, audio, video or text you publish?

1. When people chat with an AI system of yours (for example a website or messaging chatbot), are they told they're interacting with AI, unless it's obvious? Marketing / Product
2. Do you disclose when images, audio or video you publish are AI-generated or manipulated to look real (deep fakes), and when AI-generated text informs the public on matters of public interest without human editorial review? Marketing / Communications

From the help text

People should know when they're talking to a machine. 'Yes' means a clear notice at the start of the conversation.

AI used in areas such as employment, education, access to essential services, credit or insurance can be high-risk under Annex III. Deployer duties include following instructions for use, human oversight by trained staff, monitoring, keeping logs and informing people. Application dates for high-risk obligations were pushed back by the Digital Omnibus — check current dates, and start preparing now.

Asked only if you answer “Yes” to: Do you use AI to help make decisions about people — such as screening job applicants, monitoring or evaluating staff, assessing eligibility for services, credit or insurance, or assessing students?

1. For each AI use that helps make decisions about people, have you worked out — with the vendor's input — whether it's a high-risk system under the AI Act? Compliance / HR
2. Are the people who oversee these AI uses trained, with the authority to question or override the system's output? HR / Operations
3. Can you keep the system's logs for at least six months, and do you tell workers and affected people when such AI is used in decisions about them? IT lead / HR

From the help text

Classification drives your obligations. 'Yes' means a recorded assessment for each such use, and the vendor's confirmation of its own classification.

Providers — organisations that develop an AI system and place it on the market or put it into service under their own name — carry the heaviest AI Act obligations.

Asked only if you answer “Yes” to: Do you build AI systems or AI features and offer them to others under your own name?

1. Have you mapped, for each AI product or feature, whether you're a provider or deployer, which risk tier applies and which obligations follow? Product / Legal
2. If your system generates images, audio, video or text, are its outputs marked in a machine-readable way so they can be detected as AI-generated? Engineering lead

From the help text

Roles and obligations differ by product. 'Yes' means a written obligations map per product, reviewed as the AI Act's dates and guidance evolve.

A short AI policy ties it all together: which tools are approved, what data can go in, who approves new uses and how problems are reported.

1. Do you have an approved AI use policy that covers approved tools, what data may be used, human review, and how new AI uses get approved? Evidence needed Managing director / Chair
2. Is there a clear way for staff, customers or members to raise a concern about how you use AI? Operations
3. I confirm this inventory and these answers reflect our current use of AI. Managing director / Chair

From the help text

A policy makes expectations clear and gives people a safe way to use AI. 'Yes' means it's approved by management or the committee and shared with everyone.