Why do you need this service?
AI Act audit – from invisible shadow AI to a controlled system
An AI Act audit systematically assesses how an organisation designs, purchases, deploys and uses artificial intelligence. It shows where AI actually operates, the company’s regulatory role, the risk level of each application and the obligations, evidence and actions to assign to owners.
Regulation (EU) 2024/1689—the AI Act— is in force in its current consolidated version (Polish text) and applies in stages. Prohibited practices and the obligation to ensure an appropriate level of AI literacy began applying on 2 February 2025; obligations concerning general-purpose models on 2 August 2025; and the main provisions and transparency obligations on 2 August 2026. Following the 2026 changes, requirements for high-risk applications listed in Annex III are due to apply from 2 December 2027, and those for AI systems related to Annex I products from 2 August 2028. The current timetable is published by the European Commission.
Work should not be postponed until the final date. An organisation may already be using a prohibited practice, processing confidential or personal data in a public model, using AI without informing recipients or lacking evidence of required AI literacy. Some key obligations already apply, while preparing governance, data, oversight and documentation for high-risk systems takes time.
The AI Act concerns more than technology companies
Obligations may affect manufacturing, service, financial, healthcare, logistics and construction companies, employers, public bodies or software providers. The relevant factors are the specific system use and the organisation’s role rather than the sector’s name. A company may be a provider, deployer, importer, distributor, authorised representative or product manufacturer. In certain circumstances, changing the intended purpose, making a substantial modification or supplying a solution under its own brand can change its role and responsibilities.
One of the greatest obstacles is often shadow AI: tools introduced without the knowledge of IT, compliance or management. Generative AI can appear in recruitment, quality, sales, marketing, document analysis, maintenance, forecasting, customer service, programming and decision-making. We therefore begin an AI Act audit with a map of actual applications rather than a policy review alone.
What does the audit cover?
- AI inventory – in-house and purchased systems, AI embedded in equipment and applications, GPAI models, generative solutions, AI agents and tools used outside official purchasing processes.
- System qualification – checking whether a solution meets the AI-system definition and which exclusions may apply.
- Role mapping – assigning the organisation’s and providers’ roles throughout the value chain for each application.
- Risk classification – prohibited practices, high-risk systems, transparency-related risks and minimal-risk applications.
- AI governance – management mandate, system and risk owners, RACI, AI policy, tool-admission criteria and escalation paths.
- Data and individuals’ rights – provenance, quality, representativeness, confidentiality, intellectual property, personal data protection and the need for a DPIA or fundamental-rights impact assessment.
- Human oversight – supervisors’ capabilities, their ability to understand limitations, challenge outputs, stop a system safely and preserve human accountability.
- Transparency – informing people about interaction with AI, marking synthetic content where required, user instructions and communication with employees or recipients.
- Security and quality – accuracy, robustness, cybersecurity, logging, monitoring, testing, model-change management and incident response.
- Providers and contracts – due diligence, documentation, allocation of responsibilities, access to logs and information, model changes, subcontractors, portability and exit planning.
- AI literacy – roles, capability levels, training appropriate to the use context and evidence of effectiveness.
- Documentation and evidence – registers, assessments, decisions, instructions, consents, logs, test results, oversight records and corrective actions.
Four risk levels require different actions
Not every system requires the same documentation package. A prohibited practice must be stopped or redesigned. A high-risk system requires extensive management of risks, data, documentation, records, human oversight, accuracy, robustness and cybersecurity. A system subject to transparency obligations must inform people or mark content appropriately. Minimal-risk applications still benefit from ownership, basic security rules and proportionate monitoring.
Audits, conformity assessment and ISO/IEC 42001: three different purposes
- An AI Act audit assesses readiness and compliance, identifying gaps, risks and actions to implement.
- Conformity assessment of a high-risk system is a formal AI Act process depending on the role, system category and applicable procedure. We do not present our audit as a formal assessment by a notified body.
- ISO/IEC 42001 helps build a certifiable AI management system, but certification does not replace analysis of a particular system’s AI Act obligations.
The scope can be integrated with GDPR, cybersecurity, KSC/NIS2, ISO/IEC 27001 and quality-management requirements, avoiding several parallel registers and control processes. Read more about LeanTrix’s approach on the AI Act and AI governance (in Polish) page and in our ISO/IEC 42001 (in Polish) service.
What does the organisation receive?
- a register of AI systems and applications, including shadow AI,
- a map of processes, data, users, owners and providers,
- identification of the organisation’s role for every application,
- risk classification and an applicable-obligations matrix,
- a gap report with evidence and reasoning,
- a management risk heatmap,
- a list of practices requiring immediate suspension or change,
- a roadmap of quick wins, urgent actions and systemic projects,
- proposed policies, roles, KPIs, training and review cycles,
- a package preparing for AI governance or ISO/IEC 42001 implementation.
We conclude the AI Act audit with a management review. Each significant gap receives a priority, owner, deadline, expected closure evidence and a link to a specific business risk.
For implementation beyond compliance, explore Digitalisation and AI for organisations.
What is our role?
Our role – connecting regulation, technology and management processes
LeanTrix translates AI Act requirements into processes, decisions and accountability. We go beyond a legal checklist, examining how AI operates in the actual process, which data it receives, who interprets its output, who can challenge it and how the organisation retains control after a model or provider changes.
We conduct the AI Act audit with management, compliance or legal, IT, cybersecurity, the data protection officer, HR, purchasing, quality, operations, data owners and business users. We adapt the team to the applications: a recruitment tool, visual quality-inspection system, predictive maintenance, customer assistant, model supporting credit decisions and an own-brand solution require different assessments.
During the project, we:
- hold a management kick-off and establish the audit mandate, scope and criteria,
- create a safe channel for reporting official and unofficial AI use,
- conduct interviews, process observations, workshops and document reviews,
- build an AI register connected to processes, data, providers and owners,
- establish the organisation’s role and each application’s risk level,
- test human oversight against realistic errors and limitations,
- assess AI literacy according to role, context and system impact,
- analyse contracts, instructions, logs, testing, monitoring and change management,
- prioritise gaps by impact, urgency, probability and effort,
- present management with a roadmap, owners, KPIs and required decisions.
Lead expert and multidisciplinary team
We develop our AI governance practice with Dr Ścibór Sobieski, an expert in cybersecurity, artificial intelligence and management systems who combines over 35 years of IT experience with auditing and building systems aligned with ISO/IEC 42001. We add process, organisational, quality and legal expertise according to the scope.
An assessment independent of tool sales
Purchasing a specific AI model, platform or licence is not a condition of our audit. Recommendations follow roles, risks, processes and evidence quality. We do not promise an “AI Act certificate”: the regulation provides specific conformity-assessment procedures whose form depends on the system and operator’s role.
Where implementation is needed, we help create the AI register, policy, RACI model, risk assessment, qualification standard for new solutions, provider requirements, AI literacy programme, incident procedure and review cycle. We can also prepare the organisation for ISO/IEC 42001 implementation or certification (in Polish), maintaining the separation of roles required for independent assessment.
We conclude with a joint management review. The goal is a functioning AI governance system that enables safe innovation, informed acceptance of risk and responses to technological and regulatory change, rather than a folder of procedures.
A handful of facts
0
risk levels determining the scope of further action
0
possible operator roles in the AI value chain
0
coherent register connecting systems, roles, risks, providers and evidence
Implementation support
We provide support based on the Kata process, which allows us to adapt our activities to the specifics of your organization, taking into account the jointly set goals. The Kata process consists of four key elements that enable effective implementation of assumptions.
We operate according to PDCA
P
PLAN
PLAN – scope, AI map and audit criteria
In PLAN, we establish what actually needs assessment. We begin the AI Act audit with processes and uses rather than copying a ready-made policy.
- agree the sponsor, mandate, objectives, units and locations within scope,
- identify processes where AI affects people, safety, quality or decisions,
- create an initial inventory of in-house, purchased, embedded and GPAI systems, including shadow AI,
- map providers, models, data, integrations, users and recipients of outputs,
- establish operator roles and risk-classification criteria,
- select applicable AI Act, GDPR, KSC/NIS2, ISO/IEC 27001 or ISO/IEC 42001 requirements,
- establish the maturity scale and audit KPIs,
- select a sample of applications for in-depth testing and plan interviews and observations.
PLAN produces a scope charter: which applications we assess, against which criteria, with whom, using which evidence and in what sequence.
D
DO
DO – auditing actual practice and testing human oversight
In DO, we move from declarations to practice. We examine actual AI use and evidence that controls work.
- interview process owners, IT, HR, purchasing, compliance and users,
- identify shadow AI and compare actual practice with the register and contracts,
- classify each system, the organisation’s role and its risk category,
- analyse data provenance and quality, lawful processing grounds, confidentiality and copyright,
- examine instructions, transparency, logging, monitoring, testing and change management,
- verify capabilities, authority and the practical ability to exercise human oversight,
- test scenarios involving incorrect outputs, bias, data leakage, model changes and provider failure,
- assess providers, contractual clauses, information access and allocation of responsibilities,
- collect evidence and record gaps against the specific application.
DO produces a verified AI register and evidence showing which controls work and which exist only on paper.
C
CHECK
CHECK – compliance, risk, KPIs and management decisions
In CHECK, we turn observations into a clear picture of organisational readiness.
- compare evidence with applicable AI Act requirements and internal standards,
- confirm prohibited practices, high-risk systems and transparency obligations,
- assess maturity across governance, data, technology, people, providers and monitoring,
- determine residual risk and action urgency,
- measure the proportion of applications with an owner, classification, assessment and complete evidence,
- check AI literacy coverage and effectiveness,
- analyse the time needed to qualify a new tool, overdue actions and oversight test results,
- prepare a heatmap, gap report and recommendations for quick wins and systemic changes.
CHECK produces a management report explaining what to stop, improve or accept, and which resources and decisions are required.
A
ACT
ACT – closing gaps, AI governance and safe rollout
In ACT, we translate findings into a lasting approach to managing AI.
- stop or redesign prohibited practices and applications with unacceptable risk,
- implement quick wins for access, data, transparency, instructions and tool approval,
- develop an AI policy, RACI, committee or decision forum and escalation path,
- establish an AI register and a standard for assessing every new application and significant change,
- implement a risk-treatment plan and required technical and organisational measures,
- develop AI literacy for management, owners, users and control functions,
- establish KPI monitoring, periodic reviews, provider audits and incident response,
- prepare an evidence package for the appropriate conformity assessment or ISO/IEC 42001 audit,
- roll out the model from the pilot area to further processes, locations and companies.
ACT produces a functioning AI governance system that the organisation can develop as new applications, model changes and further requirements emerge.
Want to learn more? Contact us!
Our clients
