For many leaders, the question is no longer whether the organisation uses AI, but how much it is used, which processes it affects, and which requirements already apply or will apply to it.
The challenge is that many organisations lack sufficient visibility to be able to answer these questions. This is where AI Act readiness comes in.
What is AI Act readiness?
AI Act readiness is a structured assessment of an organisation’s use of artificial intelligence, with the aim of identifying how the AI Act may affect the organisation.
The assessment gives leadership a basis for understanding:
- which AI systems are in use
- which processes are affected by AI
- which parts of the organisation may be subject to stricter requirements
- which actions should be prioritised going forward
The goal is not to document full compliance with the AI Act. The goal is to gain sufficient visibility and understanding to plan further work in a risk-based manner.
Why should organisations start now?
For most organisations, the greatest challenge will not be writing documentation or establishing new procedures. The greatest challenge will be understanding how artificial intelligence is actually being used within the organisation.
The larger the organisation, the more difficult this becomes.
AI is used today through:
- generative AI tools such as ChatGPT, Copilot and Gemini
- AI features in existing business systems
- analytical and decision-support tools
- supplier solutions that contain AI functionality
Many organisations may therefore have a significantly larger AI portfolio than leadership is aware of.
The AI Act does not affect all organisations equally
The AI Act is risk-based, and the implications of the regulation depend largely on how AI is used. This means no one can determine how significant the AI Act will be without first mapping the organisation’s AI portfolio.
What does an AI Act readiness assessment include?
A typical assessment will cover the following.
Mapping the AI portfolio
Which AI solutions exist within the organisation?
Analysis of use cases
Which processes, decisions and tasks are affected by AI?
Assessment of regulatory exposure
Could any of the solutions fall within the high-risk categories of the AI Act?
Assessment of governance and control
Does the organisation have adequate guidelines, roles and processes for AI use?
Identification of measures
Which areas should be prioritised going forward?
AI Act readiness provides a basis for decision-making
It is easy to jump straight into discussions about AI governance, AI policy or ISO/IEC 42001.
For many organisations, however, it is difficult to know which actions are necessary before they have gained an overview of the current situation.
An AI Act readiness assessment gives leadership a fact-based foundation for assessing risk, priorities and further work.
For some organisations, the assessment will show that current AI use represents limited regulatory risk. For others, it may reveal the need for more extensive action relating to governance, documentation and internal control.
Start with an overview
The AI Act will not affect all organisations in the same way. The significance of the regulation depends on the organisation’s AI portfolio, use cases and risk profile.
Therefore, the first and most important step is to establish visibility.
Organisations that begin this work early will be better placed to meet both regulatory requirements and the continued development of artificial intelligence.
Not sure how the AI Act affects you?
Talk to us about an AI Act readiness assessment.
Mirjam Meling
Marketing & Communications Manager
Produces content for Certain QMS on management systems, quality management, information security and AI governance. She works with subject matter experts to communicate complex topics in a clear and practical way.
