ZetrixwebWeeks 1 to 2: scope and classify
Define a narrow use case and a measurable success metric. Map the data involved and decide whether it includes personal data and what lawful basis applies. Classify the system under the AI Act using the risk tiers, and note any transparency duties such as telling users they are interacting with AI. Decide whether a data protection impact assessment is warranted.
In parallel, run vendor diligence on any model or tooling providers: data processing terms, training use, retention, location, and subprocessors.
Weeks 3 to 10: build and test
Build with minimization, logging, and human oversight designed in from the start. Record the chain of events needed to reconstruct decisions, keep personal data out of prompts and logs where possible, and define where a person can review or override outputs. Build the disclosure users will see.
From week 6, test seriously: a representative set from real requests to measure quality, an adversarial set for injection and data exposure, and accessibility checks for the interface. Fix findings and re-run. Keep dated results as evidence.
| Phase | Key activities | Evidence produced |
|---|---|---|
| Weeks 1-2 | Scope, classify, diligence | Scope note, risk classification, vendor file |
| Weeks 3-5 | Build with logging and oversight | Architecture and data-flow description |
| Weeks 6-10 | Evaluate, red-team, accessibility test | Dated test reports |
| Weeks 11-13 | Limited rollout and review | Metrics and decision record |
Weeks 11 to 13: limited rollout and decision
Release to a small group with monitoring and a clear route to report problems. Compare results against the success metric and review incidents. At the end, make an explicit go, adjust, or stop decision, recorded with reasons and owners.
If you go, you now have the documentation and logging foundations to scale, and a realistic picture of cost and effort. If you stop, you stopped cheaply and know why.
Planning an AI pilot for EU customers? Talk to us about running one with compliance built in.
Key takeaways
- Scope narrowly, classify under the AI Act, and run vendor diligence in the first two weeks.
- Build in minimization, logging, oversight, and disclosure from the start.
- Test with representative, adversarial, and accessibility checks and keep dated results.
- End with an explicit go, adjust, or stop decision recorded with reasons.