AI Governance Responsibility Matrix
Assigns ownership across business, security, privacy, legal and IT for AI decisions and oversight.
Available soon
- Format
- Excel
- Size
- 62 KB
- Length
- 10 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Responsibilities sheet. Each row is one activity of the AI Acceptable Use & Security Policy, with the rule it serves. Each column is a role. R does the work, A answers for it, C is consulted before it is done, and I is told after. |
| 2 | Keep exactly one A on every row. The Check column says OK when a row has one A and holds only R, A, C or I. Tailor the other letters to how your organisation works. The 16 activities are the content of the matrix, so tailor them and do not delete them. |
| 3 | Where you have no one in a role, give its letters to the role that does the work and leave its column empty. Keep the single A on each row. |
| 4 | On Role holders, name who holds each role and who deputises. The counts show how many activities each role does, answers for, advises on and is told of. A deputy is bound by the same rules as the holder. A [[placeholder]] does not count as a name. |
| 5 | Read the decision rights at the foot of Matrix check. They compare the matrix with the 3 intake tiers of the AI Use Case Intake & Approval Procedure: each tier's approvers must do or answer for its decision, one of them must answer for it, and the use owner must neither do nor answer for it: nobody approves a use they own. |
| 6 | Clear every line of Matrix check that says Action needed. Approve the matrix with the policy, and review it when a role holder changes and at least every [[12]] months, with the policy (AG-19). |
| 7 | Replace the EXAMPLE holders on Role holders before approval. Delete nothing else. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Its facts name a holder for the AI governance lead (the Head of Risk), the Head of IT and the Executive Committee. Every other holder is a [[placeholder]] you replace.
Tailoring for a small organisation: one person may hold several roles, but not the two approvers of Tier 2: the AI governance lead (the Head of Risk in the example) and the Head of Information Security are two different people. Keep each activity's single A. Keep the person who proposes a use apart from the person who approves it where you can.
Tailoring for a regulated organisation: the executive decision-maker the procedure names decides Tier 3 uses (RS-07): executive management by default, or the board or its equivalent where your governance structure puts it. Where a regulator, a customer or the law expects the management body to oversee this work, name the body that does. A Critical risk is accepted by the board or its equivalent, not by executive management as such.
Tailoring where a service provider runs your IT: the service provider is usually the custodian of the tools it runs. It can do the R work of the Head of IT (RS-10) under contract. The A for every activity stays inside your organisation, and Procurement puts the AI terms in the contract (RS-09).
Delegation: a role holder may delegate the R work to a named person, never the A. Record a standing delegation in the Deputy column.
Roles named elsewhere in the pack that have no column here: the system owner, the line manager, the awareness lead. Their duties are on Role holders. Add a column if you want them in the matrix.
Responsibilities
R does it · A answers for it, exactly one per row · C is consulted before · I is told after. Yellow cells are yours to tailor. A blank cell means the role takes no part.
| Activity ID | Activity | Rule | AI governance lead | AI use owner | Head of Information Security | Data Protection Officer | Legal | HR | Procurement | Head of IT | Executive decision-maker | User | A (calc) | R (calc) | Check (calc) | What the rule says |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RS-01 | Keep the policy and the approved list up to date | AG-19 | A | C | R | C | C | C | C | C | I | 1 | 1 | OK | The policy is reviewed at least every [[12]] months, and when the law, a standard, a major tool or an incident changes the picture. Everyone acknowledges it within [[10]] working days of joining and each year (P04). | |
| RS-02 | Propose an AI use and answer the intake questions | AG-09 | I | A | I | I | C | 1 | 0 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. | |||||
| RS-03 | Screen a proposal and set its tier | AG-09 | A | C | R | C | C | 1 | 1 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. | |||||
| RS-04 | Assess the risk and impact of a Tier 2 or Tier 3 use | AG-10 | C | A | R | C | C | C | 1 | 1 | OK | The inventory lists every use with an owner, a purpose, a tool, the highest data level, a tier, an approver, a status and a review date. Owners review their uses at the tier's interval, and the whole inventory is reviewed at least every [[6]] months. A trigger (A05) forces a review within [[10]] working days. Pending that review the AI governance lead may suspend an approved running use; the approvers of its tier decide whether it resumes. | ||||
| RS-05 | Approve a Tier 1 use (RS-16 where the lead owns it) | AG-09 | A | C | C | 1 | 0 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. | |||||||
| RS-06 | Approve a Tier 2 use (RS-16 where an approver owns it) | AG-09 | A | C | R | C | 1 | 1 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. | ||||||
| RS-07 | Approve or decline a Tier 3 use | AG-09 | R | C | C | C | C | C | A | 1 | 1 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. | |||
| RS-08 | Confirm the EU AI Act role and category of a system, and record the role that clears hold H-4 | AG-17 | C | C | C | A | 1 | 0 | OK | Nobody builds an application or feature on a supplier's model API (prompts, retrieval, tools or code around a model the organisation calls), whether for staff or for customers, fine-tunes for others, brands, sells or supplies an AI system to a third party, or puts the organisation's name on a supplier's AI system, without Legal's decision first. Using a supplier's finished product as supplied is not building. Building can make the organisation a provider (EU AI Act Articles 3(3) and 25), so Legal records which role the organisation holds before the use starts. A new use is Tier 3 until then. When Legal records the deployer role the tier is set again from the answers; when Legal records the provider role or another role the use stays Tier 3, because it is outside this policy's deployer governance. A use already running carries the hold as a condition with a date. | ||||||
| RS-09 | Assess an AI supplier and put the AI terms in the contract | AG-11 | C | R | R | C | R | A | 1 | 3 | OK | A supplier of an AI tool, or of software with an AI feature, is assessed under the third-party pack before it receives Internal or Confidential data, and before a Tier 2 or Tier 3 use of it starts even with Public data (P06 TP-01, TP-05; P15 CL-16 asks for it for Confidential data only), and again on a material change (P06 TP-09). The contract carries the AI terms ST-1 to ST-8. A supplier that adds an AI feature gives notice (P06 clause CL-20), and the feature goes through intake before it is switched on. | ||||
| RS-10 | Connect an approved tool to single sign-on and apply its settings | AG-04 | C | I | C | A | 1 | 0 | OK | Sign in to approved tools with your work account through single sign-on (P13). Never use a personal or free account for work, never type a work password or access key into an AI tool, and never register for an AI tool with a work email address before it is approved (P13 JML-12). | ||||||
| RS-11 | Keep the inventory and review it | AG-10 | A | R | C | C | 1 | 1 | OK | The inventory lists every use with an owner, a purpose, a tool, the highest data level, a tier, an approver, a status and a review date. Owners review their uses at the tier's interval, and the whole inventory is reviewed at least every [[6]] months. A trigger (A05) forces a review within [[10]] working days. Pending that review the AI governance lead may suspend an approved running use; the approvers of its tier decide whether it resumes. | ||||||
| RS-12 | Check the output and answer for it (human oversight) | AG-07 | I | A | R | 1 | 1 | OK | A person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published. That person has the authority to reject it. The inventory names who this is for each use. AI output is never treated as a verified fact, a legal opinion or a finished piece of code. | |||||||
| RS-13 | Report an AI-related event and hand it to the incident route | AG-13 | R | R | A | C | C | R | 1 | 3 | OK | Report an AI-related security event or mishandling at once through the incident route (P09 IM-01). The triggers that hand over are AT-1 to AT-8. Nobody is blamed for a report made in good faith. The incident pack decides whether it is an incident and what must be reported, and its clocks apply. | ||||
| RS-14 | Run the literacy plan and keep the record | AG-18 | A | C | C | C | I | 1 | 0 | OK | Everyone who uses or oversees an AI tool completes the AI essentials module (AL-01) before access is switched on, or within [[60]] calendar days of the plan's launch if they already have access, and refreshes it every [[12]] months. People in the roles of A09 take the role modules. The organisation keeps an internal record of what each person completed. No certificate is needed (EU AI Act Article 4). | |||||
| RS-15 | Suspend an approved running use pending review (the AI governance lead), and decide whether it resumes (the approvers of its tier) | AG-10 | A | C | C | I | I | R | C | 1 | 1 | OK | The inventory lists every use with an owner, a purpose, a tool, the highest data level, a tier, an approver, a status and a review date. Owners review their uses at the tier's interval, and the whole inventory is reviewed at least every [[6]] months. A trigger (A05) forces a review within [[10]] working days. Pending that review the AI governance lead may suspend an approved running use; the approvers of its tier decide whether it resumes. | |||
| RS-16 | Approve a Tier 1 or 2 use in place of an approver who owns it (the executive decision-maker) | AG-09 | R | C | C | C | A | 1 | 1 | OK | No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing. |
Role holders
Each role in the matrix, what it does, who holds it and who deputises. The counts are the matrix's letters for the role. A deputy is bound by the same rules.
| Role, as the matrix names it | What the role does | Held by | Deputy | R (calc) | A (calc) | C (calc) | I (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|
| AI governance lead | Owns the AI policy and the approved list, screens every proposed use, keeps the inventory, approves Tier 1 uses and Tier 2 uses (with the Head of Information Security), may suspend an approved running use pending review, advises on Tier 3 and reports the measures. | Head of Risk | [[Deputy]] | 3 | 7 | 4 | 2 | OK |
| AI use owner | Proposes the use, answers the intake questions, answers for its output, names the people who check it, is consulted on the decision and signs the conditions it accepts, and asks for a review when anything changes. Never approves a use it owns. | The manager named as owner of each use on the inventory (A05) | [[Deputy]] | 3 | 3 | 9 | 1 | OK |
| Head of Information Security | Assesses the security factor, agrees the tool's conditions and approves Tier 2 uses with the AI governance lead. | Head of Information Security | [[Deputy]] | 5 | 1 | 6 | 1 | OK |
| Data Protection Officer | Advises on personal data in any use, decides with the use owner whether a data protection impact assessment is needed, and is consulted on every use of personal data. | [[or the privacy lead where no DPO is appointed]] | [[Deputy]] | 0 | 0 | 9 | 2 | Name who holds it |
| Legal | Confirms the AI Act role and category of each system, reads supplier terms, and decides whether the organisation could be a provider. | [[in-house or external counsel]] | [[Deputy]] | 1 | 1 | 5 | 1 | Name who holds it |
| HR | Advises on any use that touches recruitment, pay, performance or monitoring of staff, and on telling and consulting staff or their representatives. | [[e.g. HR Business Partner]] | [[Deputy]] | 0 | 0 | 4 | 0 | Name who holds it |
| Procurement | Makes sure no AI tool or AI feature is bought or switched on without an intake decision, and puts the AI terms into the contract (ST-1 to ST-8). | [[e.g. Procurement Manager]] | [[Deputy]] | 0 | 1 | 1 | 0 | Name who holds it |
| Head of IT | Connects approved tools to single sign-on, applies the tool's settings and keeps the technical list of what is installed. | Head of IT | [[Deputy]] | 1 | 1 | 3 | 0 | OK |
| Executive decision-maker | Decides Tier 3 uses: executive management by default, or the board where the governance structure puts it. Signs as well for a High risk outside appetite (P05). Does not accept a Critical risk as executive management: it goes to the board or its equivalent (P05 RM-04). | Executive Committee | [[Deputy]] | 0 | 2 | 1 | 1 | OK |
| User | Uses only approved tools within their data limits, checks the output, discloses AI use where the policy says, and reports mistakes. | Everyone who uses an AI tool for work: staff, contractors and supplier staff | [[Deputy]] | 2 | 0 | 1 | 1 | OK |
Roles the pack names that have no column in the matrix: System owner (Owns the system an AI feature sits in, and tells the AI governance lead when a supplier adds or changes an AI feature.) Line manager (Gives time for the literacy plan, checks that the team uses only approved tools, and sends proposals to the use owner.) Awareness lead (Runs the literacy modules and keeps the completion record, with the learning system.)
Matrix check
Matrix check
The matrix and the role holders against the rules. Every line should say 'Meets the check' before the matrix is approved. The decision rights below compare the matrix with the intake tiers.
Checks
| Check | Result | Status | What it means |
|---|---|---|---|
| Activities in the matrix | 16 | Meets the check | The 16 activities of the pack, RS-01 to RS-16, and any you add. |
| Activities with exactly one accountable role | 16 | Meets the check | One A on every row. An activity with two accountable roles has none. |
| Activities with a letter other than R, A, C or I | 0 | Meets the check | Only the four letters are allowed. |
| Roles that take part but have no named holder | 4 | Action needed | A role with letters in the matrix needs a name. A [[placeholder]] is not a name. A role with no letters may stay empty. |
| Roles listed that are not in the matrix | 0 | Meets the check | Each role on Role holders must match a column heading of the matrix. |
| Intake tiers whose decision matches the matrix | 3 | Meets the check | The 3 tiers of the AI Use Case Intake & Approval Procedure, below. |
| Overall | 1 | Not ready | The number of checks above that do not yet say 'Meets the check'. |
Decision rights by intake tier
| Tier | Activity | Check | Who decides, and the roles that must do or answer for it |
|---|---|---|---|
| Tier 1: screen | RS-05 | Matches the decision rights | AI governance lead. In the matrix: AI governance lead. |
| Tier 2: assessment | RS-06 | Matches the decision rights | AI governance lead and Head of Information Security, with the use owner consulted (the owner signs the conditions it accepts and does not approve) and the Data Protection Officer's advice recorded where personal data is used. In the matrix: AI governance lead and Head of Information Security. |
| Tier 3: assessment and executive decision | RS-07 | Matches the decision rights | The executive decision-maker your procedure names (executive management by default; the board or its equivalent where your governance structure puts it), on the AI governance lead's recommendation. In the matrix: Executive decision-maker. |
Any approver may hold or decline a use. Only the tier's approvers may approve it, and nobody approves a use they own: where an approver owns the use, the executive decision-maker takes that approver's place (RS-16, checked for Tiers 1 and 2).
Lists
RACI
R
A
C
I
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| R: responsible | Does the work. Several roles may share it. |
| A: accountable | Answers for the outcome and signs it off. Exactly one per activity. The A may also do the work. |
| C: consulted | Asked for advice before the activity is done or decided. |
| I: informed | Told after the activity is done or decided. |
| AI governance lead | Owns the AI policy and the approved list, screens every proposed use, keeps the inventory, approves Tier 1 uses and Tier 2 uses (with the Head of Information Security), may suspend an approved running use pending review, advises on Tier 3 and reports the measures. |
| AI use owner | Proposes the use, answers the intake questions, answers for its output, names the people who check it, is consulted on the decision and signs the conditions it accepts, and asks for a review when anything changes. Never approves a use it owns. |
| Head of Information Security | Assesses the security factor, agrees the tool's conditions and approves Tier 2 uses with the AI governance lead. |
| Data Protection Officer | Advises on personal data in any use, decides with the use owner whether a data protection impact assessment is needed, and is consulted on every use of personal data. |
| Legal | Confirms the AI Act role and category of each system, reads supplier terms, and decides whether the organisation could be a provider. |
| HR | Advises on any use that touches recruitment, pay, performance or monitoring of staff, and on telling and consulting staff or their representatives. |
| Procurement | Makes sure no AI tool or AI feature is bought or switched on without an intake decision, and puts the AI terms into the contract (ST-1 to ST-8). |
| Head of IT | Connects approved tools to single sign-on, applies the tool's settings and keeps the technical list of what is installed. |
| Executive decision-maker | Decides Tier 3 uses: executive management by default, or the board where the governance structure puts it. Signs as well for a High risk outside appetite (P05). Does not accept a Critical risk as executive management: it goes to the board or its equivalent (P05 RM-04). |
| User | Uses only approved tools within their data limits, checks the output, discloses AI use where the policy says, and reports mistakes. |
| AI use | One way the organisation uses an AI system, for one purpose, with one owner: summarising meeting notes with the office assistant, or forecasting stock with the warehouse system. One tool can have several uses. The inventory lists uses. |
| Tier | How much checking a proposed use needs before it starts: Tier 1 a screen, Tier 2 an assessment, Tier 3 an assessment and an executive decision. A fourth outcome, Stop, means the use is not allowed. |
| Human oversight | A named person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published, and has the authority to reject it. |
| Deployer | An organisation that uses an AI system under its own authority for its business (EU AI Act Article 3(4)). Most organisations are deployers of the AI they use. |
| Deputy | The person who acts for a role holder while they are away, bound by the same rules. A deputy may do the R work and never holds the A in their own name. |
| RS-nn, AG-nn | The activities of this matrix, and the rules of the AI Acceptable Use & Security Policy they serve. |
| (calc) | A cell or column the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Replace the holders before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Responsibilities and Role holders: information security roles and responsibilities defined and allocated, with one accountable role for each AI activity |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Responsibilities and Role holders: who does, answers for, advises on and is told of each AI governance activity, with a holder and a deputy for each role |
| ISO/IEC 42001:2023 | Clause 5.3 — Roles, responsibilities and authorities | Responsibilities and Role holders: roles, responsibilities and authorities for AI assigned and communicated |
| ISO/IEC 42001:2023 | Annex A 3.2 — AI roles and responsibilities | Responsibilities and Role holders: the AI roles and responsibilities, with one accountable role for each activity |
| ISO/IEC 42001:2023 | Annex A 3.3 — Reporting of concerns | RS-13: who reports an AI-related concern and who answers for passing it on |
| EU AI Act — Regulation (EU) 2024/1689 | Article 3(4) — “deployer” means “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” | Role holders and Definitions: an organisation that uses an AI system under its own authority is a deployer, and the matrix says who inside it does what |
| EU AI Act — Regulation (EU) 2024/1689 | Article 4(1), as replaced by Regulation (EU) 2026/1744 — providers and deployers of AI systems “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training, the context the systems are used in and the persons on whom they are used; “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Article 4(2) and (3) have the Commission and the Member States support deployers, in particular SMEs, with practical examples, and have the AI Board adopt recommendations. The replaced text applies from the Omnibus’s entry into force on 27 July 2026; Article 4 itself has applied since 2 February 2025 | RS-14: who runs the AI literacy plan and keeps the record, as Article 4 now asks |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(2) — deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support” | RS-12: oversight of each output assigned to a person with the competence and authority to judge it |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(5) — deployers monitor the operation of the high-risk system on the basis of the instructions for use; where they have reason to consider that use may present a risk within the meaning of Article 79(1) they inform the provider or distributor and the market surveillance authority “without undue delay” and suspend use; where they identify a serious incident they “immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities” | RS-13: who reports an AI event and hands it to the incident route, which holds the order of notice |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(12) — deployers cooperate with the relevant competent authorities in any action those authorities take in relation to the high-risk system | RS-08 and RS-13: Legal confirms the Act role and is consulted on reports, so it is placed to deal with an authority |
| EU AI Act — Regulation (EU) 2024/1689 | Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026 | RS-08 and RS-12: the dates from which each duty applies are those Article 113 gives, and Legal confirms them |
| EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI) | Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689 | RS-14 and RS-08: the amended Article 4 and the amended dates are the text the matrix assumes |
| NIST AI RMF 1.0 | GOVERN 2.1 — “Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.” | Responsibilities and Role holders: roles and responsibilities for managing AI risk documented and clear |
| NIST AI RMF 1.0 | GOVERN 3.2 — “Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.” | RS-07 and RS-12: roles for human oversight of AI systems defined and differentiated |
| GDPR — Regulation (EU) 2016/679 | Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” | Responsibilities: the use owner answers for each use, with the Data Protection Officer consulted where personal data is used |
| GDPR — Regulation (EU) 2016/679 | Article 24(1) — the controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation; “Those measures shall be reviewed and updated where necessary.” | Matrix check: the measures are reviewed, and updated when a role holder changes |
| GDPR — Regulation (EU) 2016/679 | Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits” | Data Protection Officer column: the officer's task includes the assignment of responsibilities, and the matrix shows where the officer advises |
| NIS2 — Directive (EU) 2022/2555 | Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices | RS-07: the executive decision-maker the procedure names decides the highest-tier uses, and the matrix names that role |
Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026
ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.
This workbook does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.
Dates are those in Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; the general date and Article 50 from 2 August 2026; Article 5(1) points (ba) and (bb) from 2 December 2026; high-risk systems under Annex III from 2 December 2027 and under Annex I from 2 August 2028.
The duties of Article 26 on deployers of Annex III systems apply from 2 Dec 2027.