Administration Guide

What this guide governs

This guide describes how administrators maintain the EU AI Act Compliance Management System throughout its operational lifecycle — not just at setup, but continuously, as the regulation phases in, as documents get reviewed, and as the organization changes.

It applies to anyone holding an administrative role over the compliance repository: the Repository Administrator, the AI Governance Owner, and anyone coordinating document reviews, user access, or audit preparation on their behalf.

What the Administrator is accountable for

The Administrator shall maintain the system across six areas. Each is covered in detail in its own section below.

Keeping the repository itself trustworthy

Before anything else, the repository has to be internally consistent — a crawler, an auditor, or the next administrator should be able to open it and immediately understand its structure without asking you.

Verify

• Repository structure matches the documented module layout
• Document naming follows the established convention exactly
• Folder organization is unchanged from the reference structure
• Version consistency across all controlled documents

What every controlled document must carry

Every controlled document in the system shall have all five of the following, without exception:

What happens at every release

Each release of the compliance system — not just the code, but the documentation set itself — follows the same sequence:

• Update the CHANGELOG with what changed in this release
• Update the README to reflect the current state
• Create a GitHub Release, tagged and versioned
• Publish a Zenodo DOI where applicable, so the release is independently citable

The five roles that must be assigned

Administration is not a single job — it is five distinct areas of accountability, and each needs a named person, even in a small organization where one person holds more than one role.

What must survive a disaster

• GitHub repository backup, kept current
• Document integrity — checksums or equivalent verification available
• Release preservation — every past release remains retrievable, not just the latest
• DOI preservation — published Zenodo DOIs remain resolvable indefinitely

When the system gets reviewed

Reviews are not optional and not only reactive. The system shall be reviewed:

• Annually, at minimum, regardless of whether anything appears to have changed
• After any regulatory change to the EU AI Act or its implementing guidance
• After any major update to the repository itself — a restructuring, a new module, a tooling change

What "ready" looks like before an inspector asks

Before any inspection — announced or not — verify the following, in this order:

• All modules are complete, not partially filled placeholders
• Registers are current, reflecting the actual state today, not a snapshot from months ago
• Evidence is available and retrievable on request, not just referenced
• Declarations are approved, with a recorded approver and date
• Traceability is maintained end to end — every obligation still maps to a document, and every document still maps to evidence

What stays maintained, always

Administration does not end once the system is set up. Five things stay under continuous maintenance for as long as the system is in use:

Frequently asked questions