Why AI Use Matters Under EU AI Act
Deployers have duties too. The AI literacy duty in Article 4 has applied since 2 February 2025, and deployers of high-risk systems must provide human oversight. Meeting either starts with knowing which AI is in use and for what.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| AI use inventory and risk classification | AI use cases registered with owner, purpose and an EU AI Act risk class. |
| Art. 4 AI literacy | A documented AI usage policy with recorded employee acknowledgments. |
| High-risk AI: assessment and human oversight | Completed impact assessments, with named oversight, gate the approval of high-risk AI use cases. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting EU AI Act for a client applies these packs in one step:
- Visibility Baseline. Log every sensitive-data finding, even when nothing is blocked.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Classify every use case on the EU AI Act ladder in the AI register
- Complete impact assessments on high-risk uses (approval is gated on them)
- Open each high-risk use case’s documentation page for the technical record
- Publish the AI Use Policy (Art. 4 AI literacy evidence)
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
Questions
Does the EU AI Act apply to a small business that only uses AI tools?
It can. Organizations that use AI systems are deployers under the Act, and the AI literacy duty applies to them. Whether a particular use is high-risk depends on what the AI is used for.
How does ProctoredAI support Article 4 AI literacy?
The AI Use Policy is generated from the client's actual configuration, shown to employees on their devices, and each acknowledgment is recorded with its version, as evidence that staff were informed.
Is the documentation a conformity assessment?
No. The AI Use Documentation page supports a deployer's technical record: identification, decisions, impact assessment, rules in force and reviewer trail. It says plainly that it is not a conformity assessment.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide