KI-Verordnung Toolkits — Arbeitsvorlagen für Compliance-Teams

The Art. 9 risk management system as a working register: risk scenarios pre-mapped to the Annex III categories, scored, with mitigation and residual risk.

• Art. 9 — risk management system
• Annex III — high-risk use cases

Annex IV turned into a section-by-section file with an evidence owner and a completeness state for every required element.

• Art. 11 — technical documentation
• Annex IV — documentation content

Training, validation and testing data under Art. 10: provenance, representativeness, bias examination and the gaps you must document.

• Art. 10 — data and data governance

The obligation with the nearest deadline — 2 August 2026, not deferred — and it applies whatever your risk tier. Touchpoint register, disclosure wording, marking register.

• Art. 50(1) — interaction disclosure
• Art. 50(2) — marking of synthetic content
• Art. 50(3) — emotion recognition

Step one of every programme: list the systems, then classify them along a decision path that puts the carve-outs before Annex III. The tier is derived, not typed.

• Art. 3(1) — is it an AI system
• Art. 5 — prohibited practices
• Annex I / Annex III

32 questions to send a supplier, the scoring to read the answers, and eight contract clauses — because a deployer's obligations depend on information only the provider has.

• Art. 25(4) — provider cooperation duty
• Art. 11 + Annex IV
• Art. 13 — instructions for use

The obligation everyone already owes and almost nobody evidences: curriculum for eight roles, a training register, and coverage that recalculates.

• Art. 4 — AI literacy
• Art. 26(2) — competent and trained oversight staff