Estimated reading time: 6 minutes
In preparation for the AI Act, organizations must identify the AI systems they use, the risks associated with them, and the control measures that have been implemented. This must be systematically documented and periodically reviewed (PDCA). The FullyInControl platform helps you centrally document, manage, and demonstrate compliance with this process.
Franklin Bolder —a consultant at Fully In Control—uses a step-by-step guide to show how to approach inventory, assurance, and reassessment in a practical and efficient way, and how to use the platform in the process.
A practical step-by-step guide
The step-by-step plan consists of five steps:
- Determine this for each information system. Is this an AI system or not?
- Classify the risk level: minimal/limited, high, or unacceptable (stop).
- High risk? Conduct a FRIA (Fundamental Rights Impact Assessment) or a similar assessment, such as an IAMA (Impact Assessment on Human Rights and Algorithms).
- Document algorithms (even for low-risk or limited-risk cases) and maintain documentation.
- Ensure compliance through a cyclical PDCA process and governance (ownership, approval, reassessment, and change management).
Below is a breakdown of each step.
Step 1: Start with your information systems – AI: yes or no
For each information system—one through which data flows and which plays a role in processing or decision-making—check whether it incorporates AI. If the answer is “yes,” proceed to step 2.
How FullyInControl supports this
In FullyInControl, you work within information systems: you add a system, assign an owner, and use an assessment form.
You can identify AI by using practical check questions. A simple and repeatable approach works best. For example, use questions such as:
- Does the system make decisions(partly) autonomously?
- How much human intervention is still involved between input and output?
- What happens "under the hood" (which algorithms/models)?
Tip: You don't always conduct this investigation internally. Sometimes you need information from suppliers to understand exactly what's happening in the system.
Step 2: Risk classification – from “okay” to “stop”
Once you’ve determined that AI is involved, the next question is: what is the risk level of this AI system under the AI Act? The basic logic is:
- Unacceptable → Stop (do not use)
- Low/limited → few follow-up actions, but often transparency requirements
- High risk → requires additional obligations and proof
How FullyInControl supports this
In FullyInControl, you record the risk classification within the information system. The platform helps ensure that your assessment is consistent, verifiable, and reproducible across the entire organization. You can supplement this with additional guiding questions to strengthen the rationale.
Step 3: High risk? Then FRIA is the standard next step
If the risk classification is high, you must conduct a FRIA (Fundamental Rights Impact Assessment). This allows you to identify, assess, and mitigate in advance any risks that the information systems may pose. And it ensures—through appropriate mitigating measures—that the use of AI systems is consistent with the values and fundamental rights that are legally protected within the EU.
FRIA vs. DPIA: complementary, not the same
- DPIA: Privacy and Personal Data (GDPR)
- FRIA: Fundamental Rights (AI Act) – Broader Impact on Fundamental Rights Due to the AI System
In practice, they complement each other: at the process level, a DPIA (data processing impact assessment), and at the system level, an FRIA for specific AI systems within that process.
How FullyInControl supports this
You can configure the process in FullyInControl so that an FRIA is automatically linked as an assessment/questionnaire for any AI system classified as high-risk. This ensures it is not a standalone task, but rather an integral part of your workflow and record-keeping. For each process, you can define a procedure that utilizes a pre-DPIA checklist. Depending on the result, a DPIA may or may not be linked to the processing.
Risks are identified through the FRIA or IAMA. These risks are directly linked to this FRIA (and thus indirectly to the AI system). This provides you with an overview of all risks associated with AI systems. If a risk has already been identified by another AI system, you can reference or link to it from another FRIA. In other words, recurring risks need only be listed and managed once.
When a risk arises, you conduct a risk analysis—for example, assessing probability and impact—and determine whether to accept, transfer, or mitigate the risk. In the latter case, you identify measures to achieve this (and determine the net risk).
Step 4: Document algorithms – even for low-risk cases
Algorithm registration isn’t just useful in high-risk situations. Even in low- or limited-risk situations , you’ll want to be able to demonstrate which algorithms you’re using, where, and for what purpose. This helps with transparency, internal controls, and inquiries from regulators.
How FullyInControl supports this
FullyInControl offers an AI registry (algorithm registry) module. With it, you can:
- record algorithms and link them to one or more information systems.
- record metadata by algorithm, such as product, supplier, and evaluation agreements.
This also helps with changes. If a supplier makes an adjustment, you can quickly identify which systems may need to be reassessed.
Step 5: Ensuring sustainability through governance and the PDCA cycle
The real difference lies in repeatability. AI evolves, processes change, and legislation continues to develop. Therefore, implement it using the PDCA cycle:
- Plan/Do: evaluate and document.
- Check: Review periodically (or when significant changes occur).
- Action: Update measures, classification, and documentation.
Governance is part of that. Decisions must be transparent. For example: Who made the assessment? And: Who approved it?
How FullyInControl supports this
- Owner-based workflow: You assign an owner to perform the review.
- Two-step approval: Add a second step, such as approval by the FG/privacy officer.
- Setting expiration dates with notifications to the responsible parties.
- Reassessment: tasks with assessment dates/expiration dates and reminders for periodic reviews, plus reassessment in the event of changes.
What this achieves (and why it is "audit-ready")
If you organize this in a coherent manner, you can demonstrate that you:
- have an up-to-date overview of AI in your information systems.
- have defined the risk level for each system and can explain your decisions.
- conducted an FRIA for high-risk situations and managed the risks and measures.
- centrally tracks algorithms and can trace where they are used.
- checks periodically and whenever changes occur to see if the situation has changed (PDCA).
That is exactly the kind of evidence that governance bodies, internal auditors, and regulators require.
Getting Started with FullyInControl
Would you like to adapt this step-by-step plan to your organization (taking into account your specific systems, roles, and review cycle)? If so, you can set this up in FullyInControl using AI checks for each information system, risk classification, FRIA workflow, and an AI registry, ensuring that the process is repeatable and verifiable.