Method guide
AI governance for SMEs: the Route in 30 days
From not knowing which AI you use to being able to show it. Seven steps, one document per step.
Where do I start?What the Route is
The Route is a working method for an SME to govern the AI it uses. It does not explain the law: the law is in the AI Act guide. Nor is it the tool: the tool is in the features. The Route is the how, in order: what you do first, what you decide next and which document is left once each step is done.
The order is not arbitrary. Without an owner, nobody decides; without an inventory, you do not know which systems anything applies to; without your organisation’s role for each system, you do not know which obligations are yours and which are the provider’s; and without classification, you do not know how much work each one needs. Policies, training and evidence all rest on what comes before.
The 30 days are the work plan, not a legal deadline. They are designed for an SME that puts in a few hours a week, with steps overlapping where they can: while you wait for a vendor’s documentation, you draft the policy. Obligations have their own dates, and each chapter says which one is its own.
If you would rather read it week by week, here is the same Route told week by week.
Who it is for
- SMEs that use third-party AI: a writing assistant, a chatbot on the website, management software that comes with AI features.
- Anyone who has received a questionnaire on AI use from a large client and needs to answer it with documents, not intentions.
- The person who has been made answerable for AI without a legal team behind them.
- Companies starting from scratch that want a clear order before buying anything.
Who it is not for
- Anyone who develops and places high-risk AI systems on the market: provider obligations are different, and this guide does not cover them.
- Anyone looking for a seal that says their company is in order. The Route produces dated, reviewable documents, not seals.
- Anyone who needs a legal opinion on a specific case. The guide organises the work; it is not a substitute for legal advice.
What you will have at the end
A name in writing and seven documents, each with its date and its author. Together they are what you can show when someone asks how you govern AI.
- Step 0, the starting step · A name in writing: who is answerable for AI in your company, with their scope, their deputy and who they report to.
- Step 1 · The AI systems inventory, in its first version.
- Step 2 · Your organisation’s role for each system, with the reasoning in writing.
- Step 3 · The classification record: level, reasoning, date and author of each decision.
- Step 4 · A file per vendor, with the questionnaire and the documentation received.
- Step 5 · The AI use policy, adopted and communicated, with read acknowledgements.
- Step 6 · The record of Article 4 AI literacy measures.
- Step 7 · The evidence file and a status report that summarises it.
The Route at a glance
Step 0 and the seven steps
Start with step 0, the starting step, and follow the order. Each chapter explains what the step is, why it exists, how it is done in three actions, the typical mistake and which document you take away.
- Step 0Who is responsibleOne person with a name, a scope and a deputy, designated in writing.Estimated time: 1–2 hours · days 1–2
- Step 1The inventoryAll the AI used in the company, including what arrived without a contract.Estimated time: First version in a week · days 1–10
- Step 2The role per systemProvider or deployer, decided system by system.Estimated time: One day · days 8–12
- Step 3Classifying the riskEach system at its level, with the reasoning, the date and the author.Estimated time: Two or three days · days 10–15
- Step 4The vendorsWhat you ask each vendor for, when you ask and where you file it.Estimated time: One week, mostly waiting · days 13–22
- Step 5The use policyClear rules on what can be done with AI, communicated and acknowledged.Estimated time: Two or three days · days 16–22
- Step 6AI literacyThe Article 4 AI literacy measures, documented.Estimated time: One week · days 20–27
- Step 7The evidenceEverything above, organised and dated so that you can show it.Estimated time: Two or three days, then ongoing · days 25–30
Which step are you on?
A few short questions on how your company uses AI and what you have documented. At the end you know which step to start with and what you can skip because it is done.
Take it with you as a PDF
The whole Route in one document, with the starting step 0, the seven steps and the template for each, to work on offline or share with whoever has to help you.
Download the Route as a PDFGet it by email
One step per email, in the Route’s order, so that you keep moving without having to remember to come back.
Get the Route by email
Seven emails, one per step, in the order of the guide. Each one summarises its chapter and links the template. The emails are written in Spanish.
Frequently asked questions
Are the 30 days a legal deadline?
No. They are the guide’s work plan, designed for an SME that puts in a few hours a week. The obligations under Regulation (EU) 2024/1689 have their own dates, which are in the AI Act timeline; the Route organises the work so that you reach them with the documents done.
Which part of the Route is a legal obligation and which is not?
Each chapter says so in its “Why” section, with its nature spelled out in words. Two examples from either end: Article 4 has required measures to support the development of AI literacy among staff since 2 February 2025 and, as worded since 27 July 2026, it is an obligation of means, not of result; the AI owner in step 0, on the other hand, is an internal methodological control, because the Regulation does not require one to be designated.
Do I need a tool to follow it?
No. The Route can be followed with documents and a spreadsheet, and each step comes with its template. What a tool changes is maintenance: keeping the inventory, the decisions and the evidence connected when something changes, with their date and their author.
What if one of my systems is high-risk?
The Route is the foundation, not the end. The deployer obligations in Article 26 apply from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach products under Section B of Annex I. The fundamental rights impact assessment applies from 2 December 2027 if your organisation falls within the scope of Article 27(1). Separately, the data protection impact assessment (Article 35 GDPR) is required where the processing calls for it, whatever the classification of the system. They are independent instruments.
How is it different from the article on the first 30 days?
It is the same method told another way. The article tells it week by week; the guide orders it by step, with a chapter for each and the document it produces.
The law, in detail
The Route points to the articles where needed, but it does not explain them one by one. That is what the AI Act guide is for: what it is, who it applies to, the risk levels and the dates.
Read the AI Act guide