Method
Six cycles, run in order, on every system.
The sequence is fixed because each step depends on the one before it. Assessment before classification produces findings nobody can act on. Remediation before assessment fixes whatever happened to be easiest to see.
The compliance journey
From first discovery to monitoring in production.
What exists
Which systems, who owns them, what they decide and what they touch. Each system gets an identity card and enters the registry.
What applies
The role under the Act, the risk tier, and the regimes that apply beyond the AI Act.
What holds
Evidence gathered control by control, tested rather than asserted, at a depth set by the risk tier.
What gets fixed
Gaps closed or mitigated, in the order that reduces exposure fastest.
What is owned
A named person accepts, mitigates or withdraws the system. The decision is on the record.
What changes
Drift, incidents and design change tracked against the position taken. A material change sends the system back to classification.
Consolidated risk scale
One tier per system, three levels.
Business teams get a single marker. It rolls up four exposures: AI regulation, privacy, cyber security, ethics and reputation. Routing to legal, privacy and security teams happens behind the scenes.
Fast track
A light-touch survey and sign-off without a committee. Most use cases stop here, and that is what keeps the process sustainable.
Targeted review
A documentary review and controls on the exposed dimensions, with the relevant experts and no one else.
Full review
Impact assessments, bias and robustness testing, committee review. A high-risk system under the AI Act is always Maximal. The reverse does not hold: a case can be Maximal for reasons of security, sensitive data or reputation.
Principles
Four rules we do not negotiate.
Next step
Apply the method to one system.
The AI system audit runs the first three cycles and prepares the next three.