Start AI Governance with a List, Then Close Your Transparency Gaps

A 5-minute brief for SMEs on mapping AI tools, understanding deadlines and checking what customers need to know.

After a month of conversations about AI risks, rules and frameworks, one question keeps coming back:

“Where do I actually start?”

Start with a list.

Before you write a policy or choose a certification, identify the AI your business already uses. That list gives you a practical way to decide what needs attention, who owns it and which transparency checks come first.

1. List the AI your business actually uses

Set aside one honest hour. Open a spreadsheet and ask each team which AI tools and features they use, including those built into existing software.

Include the writing assistant, meeting recorder, customer support chatbot, image generator and recruitment tool.

For each one, record:

• Tool and purpose: What does it help the business do?

• Owner: Who is responsible for how it is used?

• Data: What information goes into it?

• Audience: Who interacts with it or sees its output?

• Decisions: Does it influence outcomes affecting people?

Ask about actual working habits, not just approved subscriptions. A tool used through a personal account can still handle business information.

The first version does not need to be perfect. Mark unknowns clearly and give someone responsibility for checking them.

2. Match the rules to the use

The European Union’s Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. Its obligations apply in stages.

Transparency requirements under Article 50 began applying on 2 August 2026. The revised timetable places rules for certain high-risk uses, including recruitment and creditworthiness assessment, at 2 December 2027, and certain high-risk systems integrated into regulated products at 2 August 2028. Specific transition provisions can affect individual systems.

A later high-risk deadline does not mean every responsibility has been postponed.

Your list helps you ask the right questions: Does the EU AI Act cover this use? Are we supplying the system, using it, or doing both? Which obligations and dates apply?

A customer chatbot and a candidate-ranking tool need different assessments. One tool can also raise several kinds of concern.

3. Check what customers are told

Open your chatbot or call your voice agent as a new customer.

Is it clear that you are interacting with AI?

Article 50 places the system-design duty on providers, with an exception where the AI interaction is already obvious in context. Required information must be clear, accessible and provided by the first interaction.

As the business using the tool, make checking the live experience part of your routine. Confirm the disclosure works after changes to settings, integrations or website design.

A practical opening could be:

“Hi, I’m the AI assistant for [Business]. I can help with common questions.”

Then check whether customers can reach a person when needed.

4. Review labels and technical marks separately

A visible label informs a person. A machine-readable mark helps software identify AI-generated content. They serve different purposes.

For images, video and audio, review whether the content constitutes a deepfake: something that falsely appears to depict authentic people, objects, places or events. Not every AI edit automatically requires the same disclosure.

There are also disclosure requirements for AI-generated text published to inform the public on matters of public interest, with an exception where it undergoes human review or editorial control and someone holds editorial responsibility. Creative works have tailored disclosure provisions.

Machine-readable marking is primarily a provider obligation. Ask your supplier how it supports marking and detection, which exceptions or transition arrangements apply, and what happens during export. A visible “AI-generated” caption does not answer those technical questions.

5. Turn the review into assigned actions

Imagine a small retailer lists three uses: a website chatbot, an AI image tool and an assistant that drafts internal emails.

The retailer tests the chatbot’s opening disclosure, reviews published visuals for any required labels, and checks what customer information staff enter into the email assistant.

Each finding becomes an action with an owner, a due date and evidence of completion.

Keep screenshots, supplier responses and review dates alongside the tool entry. Revisit it when the tool, its purpose or its audience changes.

An hour can produce a useful first inventory. A short review can reveal obvious gaps. Neither proves full compliance, but both make the next decision clearer.

You cannot govern what you have not mapped. Build the list, then use it.

Download the free 1-page Safe AI Checklist.

Operational best practice, not legal advice.