AI Governance Engineer
GitHub

Proportionate governance for a small team.

For companies without a governance function: the controls that apply at any size, what the law scales down for you, and a first week one person can run.

Who this is for.

You have a small team, little time and nobody whose job title says governance. You probably buy more AI than you build, and some of it was signed up for by staff with a company card. The floor still applies, but the law and the standards scale the rest to your size. This route starts with what one person can set up in a week and grows from there.

  • Founders and managing directors
  • CTOs and lead engineers
  • Operations and IT leads
  • Whoever holds compliance part-time

On the learning path, start at The minimum viable stack or Shadow AI discovery.

New to the field? Read AI governance explained: the definition, the frameworks and where engineering fits.

Three questions you bring.

Each one answered in brief here, and in full in the Body of Knowledge.

  1. What is the least we must do?

    Some controls do not scale down: every AI system in production registered with an owner and a tier, prohibited practices eliminated, every accepted risk with a named acceptor and an expiry, and every agent that acts with its own identity and a tested kill switch.

    The floor that does not tailor away

  2. Does the EU AI Act ease anything for small companies?

    In form, not in substance. SMEs and start-ups get priority access to regulatory sandboxes (Art. 62(1)(a)) and fines capped at the lower of the amount and the percentage (Art. 99(6)) 1. SMEs and small mid-caps may draw up the technical documentation in a simplified form, and the quality management system is proportionate to their size (Arts. 11(1), 17) 2.

    The Act and the Omnibus

  3. We only use third-party AI. What is ours to do?

    As a deployer you own the use: the decision to deploy, the monitoring, disclosing deep fakes you publish (Art. 50(4)) and, for a high-risk system, oversight by people with the competence, training and authority to act (Art. 26(2)) 1. The contract is where you get the evidence you need from the supplier.

    Build, buy or adapt

Your route through the site.

In reading order: chapters at the section that matters, then the patterns, tools, templates, datasets and figures that turn them into work.

Week one

  1. The minimum viable stack Figure · The smallest set of controls one person can run.
  2. The minimum viable stack for a team of one Chapter 04 · A thin slice through all five layers, in the order that pays off first.
  3. A program without engineering capacity Chapter 12 · What to do when nobody can write the code yet.
  4. Acceptable use of AI by staff Chapter 12 · The first policy any company that uses AI needs.
  5. AI policy template Template · One source for the policy people approve and the rules a pipeline can run later.
  6. AI literacy curriculum Template · Role-based modules whose completions become training records.
  7. Shadow-AI Discovery Pattern · Find the AI already in use, including the free sign-ups.

Before you buy

  1. Build, buy or adapt Chapter 15 · Three routes, and the evidence burden each one carries.
  2. EU AI Act risk classification checker Tool · A first reading of role and risk class for one system, as a document you keep.
  3. Vendor / Model Due-Diligence Gate Pattern · Ask the supplier the right questions before the contract, not after.
  4. Vendor due-diligence request Tool · Build the due-diligence request for one supplier and export it.
  5. AI contract clause checklist Template · The terms to secure, each tied to the obligation it answers.
  6. Contract clauses Reference · Red flags and fallbacks in AI contracts and model licences.

Grow it

  1. Proportionate governance Chapter 13 · The tailoring matrix, by size, sector and appetite.
  2. Sandboxes and real-world testing Chapter 18 · Where a small provider can test with a regulator in the room.
  3. Maturity self-check Tool · Score the five layers and pick the one move that raises the floor.
  4. Obligations and deadlines planner Tool · Turn the dates that apply to you into a plan and a calendar file.
  5. The learning path Reference · Four stages from foundations to proof, if you are the one who will build it.

Start this week.

  1. List every AI tool the company uses, including the free ones staff signed up for. Shadow-AI Discovery
  2. Adopt a one-page acceptable-use policy and tell everyone where it is. Acceptable use of AI by staff
  3. Check each use against the Article 5 list and file the result. Art. 5 prohibited practices
  4. Find where Article 50 asks for a notice of AI interaction or a label on AI-generated content. Art. 50 transparency
  5. Run the maturity self-check and pick one move. Maturity self-check

The obligations that matter most.

The duties that reach a small company first, as a user and as a builder: literacy, prohibitions, transparency, the value chain, deployer duties, the documentation and QMS the Act scales to size, and real-world testing.

What switches on, and whenThe obligations that matter most on the SMEs and start-ups route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAhead4already apply2025-02-022026-07-272026-08-02As of 2026-09-244still to come2026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5Art. 4EU AI Act Art. 50 · applies from 2026-08-02 · In forceArt. 50EU AI Act Art. 60 · applies from 2026-08-02 · In forceArt. 60Art. 5Art. 50EU AI Act Art. 11 · applies from 2027-12-02 · DeferredArt. 11EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 25 · applies from 2027-12-02 · DeferredArt. 25EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26Art. 11Art. 17Art. 25Art. 26Art. 11Art. 17Art. 25Art. 26Source: the obligation register(/obligations)As of 2026-09-24
What switches on, and whenThe obligations that matter most on the SMEs and start-ups route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAheadDateits place on the time axis4already apply4still to come2026202820302025-02-022026-07-272026-08-022026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5Art. 4EU AI Act Art. 50 · applies from 2026-08-02 · In forceArt. 50EU AI Act Art. 60 · applies from 2026-08-02 · In forceArt. 60Art. 5Art. 50EU AI Act Art. 11 · applies from 2027-12-02 · DeferredArt. 11EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 25 · applies from 2027-12-02 · DeferredArt. 25EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26Art. 11Art. 17Art. 25Art. 26Art. 11Art. 17Art. 25Art. 26As of 2026-09-24Source: the obligation register (/obligations)As of 2026-09-24
What switches on, and when The obligations of this route on the date each first applies, drawn by status, and on its later dated steps (a square, filled once reached); the dashed line is the date the rows were last reviewed. Treat what comes before the line as work for now, and read what comes after it as the time left to prepare.
Data table
When the obligations on the SMEs and start-ups route apply
DateObligationStepStatus
2025-02-02EU AI Act Art. 4: AI literacyApplies fromIn force
2025-02-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Applies fromIn force
2026-07-27EU AI Act Art. 4: AI literacyLater step: Omnibus rewording in force: providers and deployers take measures to support AI literacyIn force
2026-08-02EU AI Act Art. 50: transparency for certain AI systemsApplies fromIn force
2026-08-02EU AI Act Art. 60: testing in real-world conditions outside sandboxesApplies fromIn force
2026-12-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Later step: New bans on AI-generated NCII and CSAM applyIn force
2026-12-02EU AI Act Art. 50: transparency for certain AI systemsLater step: Marking grace for existing systems endsIn force
2027-12-02EU AI Act Art. 11: technical documentation (Annex IV)Applies fromDeferred
2027-12-02EU AI Act Art. 17: quality management systemApplies fromDeferred
2027-12-02EU AI Act Art. 25: responsibilities along the AI value chainApplies fromDeferred
2027-12-02EU AI Act Art. 26: deployer obligations for high-risk systemsApplies fromDeferred
2028-08-02EU AI Act Art. 11: technical documentation (Annex IV)Later step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 17: quality management systemLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 25: responsibilities along the AI value chainLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 11: technical documentation (Annex IV)Later step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 17: quality management systemLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 25: responsibilities along the AI value chainLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
Obligation Applies Evidence
EU AI Act Art. 4 AI literacy AIGE-OBL-EUAIA-ART4 In force · Literacy programme as code; role-based training records; onboarding gates
EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans) AIGE-OBL-EUAIA-ART5 In force · Policy-as-code blocklist; input/output guardrails; refusal and abuse detection
EU AI Act Art. 50 transparency for certain AI systems AIGE-OBL-EUAIA-ART50 In force · Content labelling and machine-readable marking (e.g. C2PA-style); chatbot disclosure banner
EU AI Act Art. 25 responsibilities along the AI value chain AIGE-OBL-EUAIA-ART25 Deferred · Value-chain due-diligence gate; provider/deployer responsibility allocation; AIBOM and model/data cards collected from upstream providers
EU AI Act Art. 26 deployer obligations for high-risk systems AIGE-OBL-EUAIA-ART26 Deferred · Deployment registry; monitoring hooks; assigned oversight and logging retention
EU AI Act Art. 11 technical documentation (Annex IV) AIGE-OBL-EUAIA-ART11 Deferred · AIBOM (CycloneDX ML-BOM, SPDX 3.0 AI); auto-generated technical documentation; model cards
EU AI Act Art. 17 quality management system AIGE-OBL-EUAIA-ART17 Deferred · QMS-as-code; versioned policies; pipeline controls and change management
EU AI Act Art. 60 testing in real-world conditions outside sandboxes AIGE-OBL-EUAIA-ART60 In force · Real-world testing plan; Art. 61 informed-consent records; test monitoring, logging and incident hooks

Every obligation in the register

Sources

  1. [1] Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026 (Arts. 26(2), 50(4), 62(1)(a) and 99(6)). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)
  2. [2] Regulation (EU) 2026/1744 (Digital Omnibus on AI) (amended Arts. 11(1) and 17: simplified technical documentation and a proportionate QMS for SMEs and small mid-caps). Publications Office of the EU (EUR-Lex). 2026-07-24. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng (verified: primary)

Other routes.

  1. For engineers ML, platform, MLOps, application and security engineers who build and run AI systems.
  2. For CISOs and risk leads CISOs, heads of risk, model risk managers, internal audit and third-party risk managers.
  3. For legal counsel and DPOs In-house counsel, data protection officers, privacy and compliance leads, and contract managers.
  4. For executives and boards Board members, executive committees, and chief AI, data and technology officers.
  5. For the public sector Public bodies and operators of public services: CIOs, service owners, procurement and oversight.
  6. AIGP candidates The public AIGP body of knowledge read against this site. Not affiliated with or endorsed by IAPP.
  7. Certifications Certifications and assessments in AI governance, and what each one evidences.

Start at the top of the route.

Step 01 is The minimum viable stack. Each step after it builds on the one before.

Open step 01 All routes