Before introducing an AI system into a business workflow, record what it will do, who is accountable for its use, what information it handles, how a person will check its output and where relevant evidence will be kept. This gives professional-services firms and regulated SMEs a practical basis to approve a use case, add controls, defer it or seek advice.
This is an operational readiness record, not proof of legal compliance. The appropriate checks depend on the system, its purpose, the data involved and the firm’s circumstances.
What to record before use
- Purpose and workflow: the task supported, intended users and whether the system drafts, recommends or takes an action.
- Ownership and provider: the accountable business owner, service and configuration being considered, and the provider information or terms reviewed.
- Data boundaries: the information entered or retrieved, including whether client-confidential or personal information may be involved, and who has authority to approve its use.
- Human checks: who reviews outputs, what they must verify, and who can correct, pause or escalate use.
- Evidence and response: what records are available, who can retrieve them, and how errors or incidents are raised and handled.
Use the record to make a readiness decision
Document the decision-maker, the controls required before use, unresolved questions and the point at which the decision will be reviewed. If provider terms, data handling or review responsibilities are unclear, keep sensitive information out of the workflow until the firm has resolved the question. A limited pilot using appropriate material can help test a process, but does not establish that the same setup is suitable for more sensitive work.
Revisit the record if the provider, configuration, data, workflow or intended use changes. Where legal or regulatory applicability is uncertain, record the uncertainty and seek appropriately qualified advice rather than treating the operational record as a legal conclusion.
Source and approach
This practical checklist is informed by the Pattrn Data Question Hub source question, EU AI Act duties: SME deployer map before launch. It adapts the system, purpose, role, risk, oversight, data, monitoring and incident-mapping themes into a business readiness record; it does not determine whether a particular legal duty applies.
How Pattrn Data can help
Pattrn Data’s AI Risk & Efficiency Audit helps firms map current AI use, data boundaries, ownership and review controls, then identify practical readiness steps before wider implementation.