← Resource library1. Kickoff & scope
- ✓Confirm entities, systems, business units, geographies and dates in scope.
- ✓Agree deliverables, stakeholders, cadence and escalation route.
- ✓Create assumptions, decisions, evidence-request and change logs.
2. Discovery
- ✓Build the AI inventory from workshops plus technical, procurement and financial evidence.
- ✓Look for Shadow AI and newly enabled SaaS features.
- ✓Capture intended purpose, owners, people affected, data, vendor/model, geography and change history.
3. Role & classification
- ✓Map provider/deployer/importer/distributor and relevant GPAI relationships per system.
- ✓Screen prohibited practices, high-risk pathways and Article 50 transparency duties separately.
- ✓Document negative as well as positive classifications so another reviewer can reproduce the reasoning.
4. Evidence & gap analysis
- ✓Map applicable requirements/controls to evidence reviewed.
- ✓Separate control design from evidence that the control operates.
- ✓Record missing, stale or insufficient evidence as gaps with a clear closure requirement.
5. Remediation
- ✓Prioritise by consequence, urgency, dependency and effort.
- ✓Give each action an owner, target date, evidence of completion and definition of done.
- ✓Track residual risk and management decisions where risks cannot be fully removed.
6. Executive readout
- ✓Lead with the few material findings and business decisions leadership must understand.
- ✓Show priority actions, owners, dependencies and timeline rather than replaying every working paper.
- ✓State scope, assumptions and unresolved escalations clearly.
7. Handover & follow-through
- ✓Reconcile the final inventory, role map, classifications, gaps, actions and evidence pack.
- ✓Agree how the client will maintain the inventory, detect changes and monitor actions.
- ✓Define next review points and any work requiring legal, privacy, security or technical specialists.
Internal quality review before handover
- □Can another consultant reproduce every material classification from the facts and evidence?
- □Does the report distinguish facts, assumptions, interpretations and unresolved questions?
- □Do system versions and dates match the evidence and current deployment?
- □Are current authoritative sources used where the training pack may be outdated?
- □Does every material finding explain why it matters and what closes it?
- □Do remediation actions have owners, dates and evidence-based definitions of done?
- □Are scope limitations and deferred systems visible rather than implied to be assessed?
- □Are specialist escalations precise, tracked and reflected back into final decisions?
Final handover pack
At minimum, expect a reconciled AI inventory, role/exposure map, classification rationale, evidence/gap register, prioritised remediation roadmap, decisions/assumptions/escalation record and executive readout. The exact pack should remain proportionate to the engagement scope.