What a Phase 01 Diagnostic looks like.

1. Executive summary

CLIENT currently uses 11 AI systems identified during the inventory phase, of which 1 is classified as high-risk under Annex III, 4 as limited-risk requiring transparency obligations, and 6 as minimal-risk. No prohibited practices were identified.

The high-risk system (an automated CV-screening tool used in recruitment) requires the full compliance package binding from August 2026: risk management system, data governance, technical documentation per Annex IV, deployer obligations including human oversight, monitoring logs, and informing affected workers.

Three of the four limited-risk systems (chatbot on the customer portal, AI-generated marketing copy, an internal summarisation assistant) require basic transparency notices to be added by August 2026.

The current AI literacy programme is informal. Article 4 of the Act has bound since February 2025; the programme should be formalised within two months to close this gap.

Total estimated implementation effort to reach August 2026 readiness: 8-10 weeks of focused work, sequenced across three workstreams.

2. Scope of the diagnostic

This diagnostic covers EU AI Act applicability and readiness for AI systems currently in use, planned for use within twelve months, or embedded in third-party software in the company's stack. It does not address GDPR data flows (subject of a separate engagement) nor sectoral regulatory regimes (CSSF, AIFMD II, MiCA) that may overlap.

3. AI system inventory

The inventory identified 11 AI systems across the business. Each was documented with: function, vendor (where third-party), data inputs, decision outputs, business owner, and approximate user volume.

4. Risk classification under the EU AI Act

Each inventoried system was assessed against the Act's classification framework: prohibited practices (Article 5), high-risk under Annex III, high-risk under Annex I, limited-risk transparency obligations (Article 50), or minimal risk.

5. Obligation gap analysis

For each system above minimal risk, the obligations binding by August 2026 were mapped against the current state. The gap analysis surfaced 17 distinct obligations across the four classified systems, of which 12 are not currently met.

Critical gaps (those at material risk of late delivery without immediate action):

• CV screening tool, risk management system documentation not in place
• CV screening tool, data governance: training data quality assessment not documented
• CV screening tool, deployer obligation: workers and works council not yet informed of AI use in recruitment
• AI literacy, programme exists informally; Article 4 documentation not in place (binding since February 2025)

Non-critical gaps (transparency notices, log retention configuration, monitoring scripts) listed in full in Appendix B.

6. Prioritised action plan

The action plan below sequences the gap closures across three workstreams running in parallel over 8-10 weeks. Estimated effort and recommended owner are noted for each.

7. Recommended next phase scope

Recommended Phase 02 (Roadmap) and Phase 03 (Build) would convert this diagnostic's action plan into delivered work. Estimated combined scope: 10-14 weeks across three workstreams.

Sub-scopes that may be considered for separate engagements:

• GDPR data flow review (overlap with AI Act data governance, bundling efficiency available)
• Production AI workflows for ongoing AI register maintenance and monitoring, suitable agentic workflow build
• Recruitment process review (the high-risk CV system is the most legally exposed AI use; broader process review may be warranted)