1. Discover — Your AI Usage & Obligations
Before you can generate anything, you need to know what you're actually working with. This is where every readiness journey starts.
Where AI is probably already in your organisation
- Writing and communication — ChatGPT, Copilot, or similar tools used for emails, reports, marketing copy
- Customer-facing systems — chatbots, support ticket routing, automated replies
- HR and recruiting — CV screening tools, interview scheduling assistants
- Development — AI coding assistants embedded in your engineering workflow
- Decision support — any tool that scores, ranks, flags, or recommends based on data about people
What this triggers
If any of the above sounds familiar, your organisation is already a deployer of AI systems under the EU AI Act — the obligations that come with that role apply regardless of whether you built the AI yourself. The next step is figuring out which of your AI systems carry higher obligations (see Article 4 AI Literacy and risk classification), which is exactly what the Generator step turns into real documents.
Common questions
Does using ChatGPT or Copilot at work count as "using AI"?
Yes. If employees use AI tools for drafting, coding, customer support, marketing, or decision support, your organisation is a deployer of AI systems under the EU AI Act, with obligations attached regardless of company size.
Do I need to know every AI tool used across my company?
You need a reasonable inventory — the AI systems your teams actually rely on for real work. Shadow tools individual employees try once are lower priority than tools embedded in regular business processes.
What if I don't build AI, I just use tools that have AI features?
You're still a deployer, which carries its own obligations distinct from a provider (the company that built the AI system) — deployers must still ensure appropriate use, human oversight, and staff AI literacy.
How do I know if what I'm doing is high-risk?
High-risk classification depends on the AI system's intended purpose and its potential impact on safety or fundamental rights — for example AI used in hiring, credit scoring, or biometric identification is far more likely to be high-risk than an AI writing assistant.
What's the very first thing I should do?
List every AI system currently in active use across your organisation, however informal — that inventory is the foundation every other compliance step builds on.