Minimization and retention
Send only what is necessary and document how long it is kept.
Privacy
Responsible use
Safety and regulation by design.
Risk, data and external effects must be defined before adding autonomy.
Essential controls
Protection depends on the context of use.
Permissions and confirmation
Limits tools and requires approval for sensitive effects.
AgentsProportional verification
Review and evidence increase as the impact of the error grows.
RiskOperational regulatory map
The legal classification depends on the territory and the specific use.
Document the system
Provider, version, data, purpose, managers and users.
GovernanceClassify the risk
Identify affected people and foreseeable consequences.
AssessmentCheck every update
A new model or tool can alter obligations and controls.
Follow-up
ANALYSIS
Related analysis
AI literacy under the AI Act: a guide to training staff and documenting compliance
Article 4 of the EU AI Act requires providers and deployers to take measures to ensure that their staff and other people operating or using AI systems on their behalf have a sufficient level of AI literacy. This guide explains how to turn that obligation into role-specific training and keep a record of the measures taken, without mistaking documentation for automatic proof of compliance.
14 Oct 2026 ↗
Article 16 of the AI Act: High-Risk AI Provider Obligations and How to Verify Them
Article 16 of the AI Regulation assigns specific compliance, documentation, monitoring, and communication duties to providers. This guide distinguishes these tasks from those of the deployer and proposes verifiable controls, with caution regarding dates and sanctions.
13 Oct 2026 ↗
AI agents that modify records: who is responsible under the AI Act?
An agent that uses tools and changes data does not thereby acquire its own legal category or automatically become high-risk. The analysis depends on its purpose, configuration and use, and on the role each organisation plays throughout its lifecycle.
13 Oct 2026 ↗
AI Decision Logs: How to Document Risks, Controls, and Evidence
A practical guide to connecting an AI system’s risks with the measures taken and the evidence that they work, without confusing an internal log with legally required documentation.
13 Oct 2026 ↗
AI Act Article 9: Turning Risks into Verifiable Controls and Tests
A practical guide to linking each risk in a high-risk AI system to a measure, a test and documented evidence, while distinguishing legal requirements from operational recommendations.
08 Oct 2026 ↗
AI literacy under the AI Act: how to design useful training and document it
A practical guide to building AI literacy around specific tasks and risks. It distinguishes what institutional sources say from operational measures organisations may choose to adopt.
01 Oct 2026 ↗From the model to the real system
Safety cannot be inferred from a model sheet. It depends on the data, permissions, affected people, connected tools, and ability to stop or reverse actions.
Govern
Define owners, purpose, inventory, acceptance criteria, and incident channels before deployment.
Map
Describe users, data, third parties, foreseeable impacts, and out-of-scope uses.
Measure
Test quality, bias, privacy, instruction injection, and failure recovery with recorded evidence.
Manage
Limit privileges, require confirmation for sensitive actions, monitor changes, and maintain a rollback path.
Supervision
Stop sensitive actions before producing external effects.
Source and date
Every claim must retain the official page consulted and the verification date.
Fuentes primarias y técnicas
Referencias utilizadas para ampliar y revisar esta página.