Assess Applicable Deployer Duties Before Authorising the AI Use
An SME using an AI system in the EU should identify its role and the system's intended use before applying EU AI Act duties. A high-risk deployment carries different operating obligations from a lower-risk tool, so record the classification and its basis first.
Before launch, prepare a record of the system, its purpose, responsible people, data and proposed controls. Use it to support the applicability review and explain how the system would be used and how problems would be investigated.
The safest approach is to map role, risk, oversight and evidence before deployment
Suggested topics for the pre-launch record are the system, actor role, risk classification, intended purpose, provider instructions, authorised users, human oversight owner, input data controls, monitoring process, log retention and transparency or incident routes. Establish which legal duties apply separately; this list is an operating checklist, not a statement that every deployment requires the same records.
Record whether the SME is acting as a deployer, provider, importer, distributor or another actor for the use under review. Include third-party tools used in client service, HR, finance, operations or compliance. Flag modifications, own-name marketing and changes of intended purpose for the role assessment.
Map AI use cases and evidence gaps before launch
Start with an AI system register, not a policy document
The source guide is right to put visibility first. For each system, record its name, vendor, business owner, purpose, process, user group, data categories, affected customers or staff, deployment date, risk classification, approval status and review date.
Record public AI used for first-draft emails, embedded assistants in case management products and automated scoring in workflow platforms as separate uses. Assess the data, outputs and review requirements for each, and update the register when the use changes.
For high-risk systems, turn provider instructions into operating controls
For a system assessed as high-risk, ask the reviewer to identify the applicable duties concerning provider instructions. Record who reviewed those instructions, which users are authorised, what input data requirements apply, when human review is required and which outputs must not be accepted automatically.
Resolve unclear provider instructions with the supplier before launch. Where output review is required, define the reviewer, review standard, escalation route and evidence to retain.
Assign human oversight to named people with authority
Name the people authorised to review, challenge, override, pause or escalate the AI system's output. Check that they have the competence, time and authority to do so, including training and permission to challenge a recommendation.
The oversight map can identify the business owner, day-to-day user, reviewer, approver, incident contact and accountable senior lead. For client files, employment or credit decisions, compliance workflows and regulated advice, record who made the final decision and what they reviewed.
Put named AI ownership and review routines in place
Document input data, monitoring, logs and incident routes
The EAB guide highlights several operational duties that SMEs often miss. Where the SME controls input data, include relevance, representativeness and suitability for the intended purpose in the review. Record the checks performed and any limitations.
Plan how to record errors, unexpected outputs, user complaints, performance concerns, override patterns, data quality issues and use outside the provider's limits. Assign an owner to review those records and decide what action is needed.
Logs matter because they support audit and incident reconstruction. Before launch, the firm should know whether logs are created automatically, who controls them, where they are stored, how long they are retained and whether they can show the inputs, output, user, timestamp, model or system version, review decision and override reason. If the logs are controlled by the vendor, the contract should say how the SME can access them when needed.
Check transparency and data protection duties together
Ask the reviewer to establish whether the proposed use requires information for customers, employees or other affected people. Record what they need to be told about AI use and any contact or challenge route that applies.
Use the same system and data facts for the data-protection review. Where personal data is involved, ask the responsible reviewer to assess DPIA screening, lawful basis, retention, access controls, processor terms and explanations of decisions. Record the requirements identified for the proposed use.
A practical pre-launch checklist for SMEs
- System: What AI system is being used, who provides it and where does it sit in the workflow?
- Purpose: What is the intended use, and what uses are out of scope?
- Role: Is the firm acting as deployer, or has customisation changed the role?
- Risk: Is the use prohibited, high-risk, limited-risk or lower-risk under the EU AI Act?
- Instructions: Which provider instructions apply, and how have they been turned into internal controls?
- People: Who owns the system, who reviews outputs and who can stop use?
- Data: What input data is used, who controls it and what quality checks apply?
- Monitoring: What issues, complaints, overrides and incidents are tracked?
- Logs: What records prove how the system was used and reviewed?
- Transparency: Who must be told about AI use, and how can they challenge an outcome?
Build an approval-ready AI deployment checklist
Conclusion
Keep the applicability decision alongside the operating record: system and classification, provider instructions, oversight, input data, monitoring, logs, data protection and incident handling. Give unresolved questions to the approval owner before launch and record any restrictions on use.
Want to find the practical AI opportunity?
Bring the proposed system's intended-use record, provider instructions and unresolved approval questions to the discussion. Identify the work still needed before a launch decision.
