This is a working checklist, not legal advice — every organization's obligations depend on its specific use cases, data, and jurisdiction. Treat it as a starting point for a conversation with your legal and compliance teams, not a substitute for one.

Foundational data governance

  1. Map every system that feeds data into an AI tool — connectors, uploads, and integrations all count, including ones set up informally by individual teams.
  2. Classify data by sensitivity before it reaches a model: public, internal, confidential, and regulated (PII, health, financial) each need different handling rules.
  3. Confirm a Data Processing Agreement is in place with every AI vendor that touches regulated data, covering retention, sub-processors, and deletion rights.
  4. Document your lawful basis for processing personal data through AI systems under GDPR Article 6, and update your Records of Processing Activities.

EU AI Act specific steps

  1. Classify each AI use case by risk tier (unacceptable, high, limited, minimal) — the obligations attached to a use case scale directly with its tier.
  2. For high-risk use cases, complete a conformity assessment and maintain the required technical documentation before deployment.
  3. Implement human oversight for any use case that falls in the high-risk tier — this typically means a named person reviewing and approving consequential outputs before they take effect, not just a theoretical ability to intervene.
  4. Ensure transparency obligations are met: users interacting with an AI system need to know they're doing so, and AI-generated content that could be mistaken for human-generated content needs to be labeled where the Act requires it.

Security and access controls

  1. Enforce SSO and role-based access so AI tool access follows the same identity governance as every other enterprise system.
  2. Confirm PII and sensitive data are redacted or tokenized before being sent to any third-party model provider, unless a specific agreement permits otherwise.
  3. Test your prompt-injection and data-exfiltration defenses against your actual connector setup, not just in the abstract.

Auditability

  1. Maintain an immutable audit log of every AI interaction that touches regulated data or takes a consequential action — who asked, what was retrieved, what was generated, and who approved it.
  2. Confirm the audit log can be exported in a format your compliance and legal teams can actually use during a regulatory inquiry, not just a raw database dump.
  3. Set a retention policy for audit records that matches your regulatory obligations, which are often longer than your default data retention policy.

Ongoing operations

  1. Re-run the risk classification whenever a use case's scope changes — a tool that started as an internal drafting assistant can drift into a high-risk use case without anyone updating its classification.
  2. Train employees on acceptable use, including what data should never be pasted into an AI tool that hasn't been vetted by your security team.
  3. Review vendor compliance posture (SOC 2, ISO 27001, sub-processor lists) at renewal, not just at initial signing.