Step 0
Who is responsible for AI in your company
By the end of this step you will have a written, dated appointment: who coordinates AI, with what scope, who stands in for them and who they report to.
What this step is
Before inventorying anything, you need to know who will do it and who will answer for the list still being alive in six months. In an SME that job usually lands on someone without anyone deciding it: the IT person, the quality lead, the HR manager. Step 0 turns that de facto situation into a management decision, written down and dated.
The role goes by many names —AI lead, AI coordinator, AI Officer— and the name matters little. What matters is that there is a specific person with a specific remit: keeping the inventory, coordinating classification, looking after the use policy, organising AI literacy measures and keeping the evidence of all of it. It is not a full-time post: in most SMEs it is part of the work of someone who keeps their main job.
This step does not create a department or a committee. It creates a single point of coordination, a named person, whom every team knows it must tell before switching on a new AI-enabled tool.
Why
Regulation (EU) 2024/1689 does not require you to appoint a person responsible for AI. It is an internal methodological control, not a legal obligation: an organisational decision your company makes because, without it, the rest of the Route has no owner. If someone presents that role to you as a mandatory post, they are describing an obligation that does not exist.
What the Regulation does ask for is measures, and someone has to coordinate them. Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, and it has applied since 2 February 2025. And whoever deploys a high-risk system will have to assign its human oversight to natural persons who have the necessary competence, training and authority: Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach products under Section B of Annex I. Neither creates a post; both are easier to sustain if someone coordinates them.
The DPO is something else, and the two should not be mixed. The GDPR requires one to be designated in the three cases of its Article 37(1): where the processing is carried out by a public authority or body, except courts acting in their judicial capacity; where the core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale; and where they consist of processing on a large scale of special categories of data or of personal data relating to criminal convictions and offences. In Spain, Article 34(1) of the LOPDGDD (Ley Orgánica 3/2018) adds entities that must designate one in all cases, such as professional associations, schools and other education centres, insurers, and healthcare centres legally required to keep patient records, except health professionals practising on their own. The DPO is a legal role in those cases; the person responsible for AI is a methodological role. They may be the same person, but they are two separate remits and are appointed separately.
How, in three actions
Choose the person and write down the scope
Pick someone who knows the tools and deals with every department; no legal background is needed. Write half a page on what you are asking of them —inventory, classification, policy, literacy and evidence—, how many hours a month you recognise for it and what they may do: request information from any team and pause the use of a tool while it is reviewed. Without that authority, the remit is window dressing.
Name a deputy and a reporting line
Decide who stands in during holidays or if they leave the company, and who they answer to: usually management, on a fixed cycle, quarterly for instance. If you have a DPO, write down how the two coordinate when a system processes personal data. If the same person is going to be both DPO and AI lead, check that the workload is realistic and keep the two remits in separate documents.
Date the decision and announce it
Management records the appointment with a date, in minutes or in an email to the person appointed, and announces it to the heads of each area with one simple instruction: before buying or switching on an AI-enabled tool, tell this person. Keep the document with the rest of your governance evidence: it is the first thing anyone will ask for when they want to know who decides about AI in your company.
The typical mistake
Appointing someone verbally, with no scope and no authority.
A verbal remit dissolves at the first business emergency, and afterwards nobody can check what was asked or since when. The symptom is familiar: the inventory is kept by whoever has time, the policy was written by someone who has left and nobody knows who reviews the classifications. You avoid it with a dated half page stating what is assigned, to whom, with how much time and with what power to request information or stop a use.
Estimated time
One or two hours of work, on days 1 and 2 of the Route. It is the shortest step, and the next seven depend on it to have someone driving them.
What you take away
The written, dated appointment of the person responsible for AI: scope of the remit, time recognised, deputy, reporting line and how they coordinate with the DPO, if there is one.
How it works in Alethexis
When the structure grows, Alethexis captures it in two screens: the Governance structure assigns, among the members of your organisation, the AI Officer and the management representative and, where applicable, the DPO; the RACI matrix allocates each governance activity across Responsible, Accountable, Consulted and Informed.
Each activity has at least one Responsible and exactly one Accountable, and the matrix is not generated until all of them do; each generation is a new PDF version, with its SHA-256 integrity hash recorded and added to the organisation’s evidence.