Define context and scope

Open the AI Compliance Assistant

In the sidebar open Wizards and select the Artificial Intelligence card. The AI Compliance Assistant (AIMS) overview lists the chapters of the assistant, each with a ring showing its publication state. Clicking the Context & Scope row opens the first page of the chapter; the pencil at the end of the row leads there as well.

Read the introduction

The Introduction to the AI Compliance Assistant page presents the legal framework (the AI Act and ISO/IEC 42001) and lists, under Application timeline of the AI Act, the six stages under Article 113, from the prohibited practices to high-risk systems as safety components. The page saves nothing. The progress bar at the top names the four pages of the chapter: Introduction, Organisation Profile, Organizational Context and Scope. Next takes you to the organisation profile, Back to overview returns to the chapter list.

Check the basic information

The Organization Profile page starts with the Basic information card. Answer Is your organization part of a corporate group (Konzern)? with Yes or No; after Yes a second question asks whether your company is the parent company. Enter Company name, Legal form and Number of employees. Contact address of the organisation and Reachability (email or phone) are optional; they later appear in the instructions for use of every system you provide as a provider.

For Country of establishment of your company Cenedril suggests the country of the first location and marks it as a suggestion. There is no confirm button: the next save turns the suggestion into your own entry. Check it before saving.

Pick a band under Annual turnover and Balance sheet total. From the headcount and one of the two financial figures Cenedril derives the Derived size class: line; the class is never stored, every page recalculates it. The simplifications of the AI Act depend on it, and the scope statement and AI policy name it.

Complete vision, locations and departments

Under Vision & purpose of the organisation describe in a few sentences what your organisation stands for; the text later appears as a hint above the AI objectives. In the Offices & locations card use Add office to create every location with Location name and Country. In the Departments card tick the departments you have and add any missing ones under Additional / custom departments.

When in doubt, add it: entities, locations and departments form the selection lists on the Scope page, and whatever is missing here cannot be selected there. A location you deliberately deselect later does no harm anywhere.

Save the profile

The footer offers two ways. Save as Draft stores everything without validation. Save & Continue checks the required fields (company name, the parent company name for a subsidiary, and name, address and country for a designated authorised representative), publishes the profile and opens the organizational context. The banner above the recommendations tells you whether the displayed state is published, a draft, or not yet saved. If both buttons stay greyed out, you lack the permission for this page.

Select external and internal issues

The Organizational Context page shows an accordion of categories under External issues and Internal issues. Expand a category and tick every issue that applies to your use of AI. An issue is a circumstance: “Dependence on model and tool providers” applies as soon as you use a provider’s model, regardless of whether a problem ever arises from it.

Once an issue is selected, the Additional note (optional) field appears below it. One or two keywords are enough; they reappear in the scope statement in brackets after the issue. Anything that appears in no category you add via Add your own issue. Below the lists Cenedril counts the selected issues.

Determine the interested parties

In the Interested parties section tick the people, groups and bodies with a legitimate interest in your use of AI or affected by it. Anyone missing from the grid is added under Your own interested parties using the input field and Add, for instance a specific customer group.

For the internal issues and the parties, a joint session with the departments already using AI, plus IT and data protection, pays off. Two questions carry the meeting: where is AI already at work today, including unofficially? And who bears the consequences when an AI output is wrong?

Adopt needs and expectations

The Needs and expectations section appears as soon as a stored suggestion belongs to both a selected issue and a selected party. The suggestions are grouped by party. Ticking a need records that your AI management system takes on this expectation. Adopt only what you are prepared to address. Under Your own needs record what a party expects beyond the suggestions.

Answer the profile questions

Under Your organisation’s profile answer the yes/no questions on climate change, developing your own AI, public authority, small or medium-sized enterprise, very large online platform and supervised financial institution. Every answer has effects beyond this page:

• Is climate change a relevant issue for your use of AI?: as long as you click nothing, the question enters the saved state as answered “No”. An explicit click is worth it.
• Do you develop AI systems yourselves or operate your own AI model?: a Yes additionally makes your organisation a provider. It adds the AI provider policy to the document set, shows the data quality and AI development rows in the AI roles, offers the development objectives among the AI objectives, and opens the questions on the quality management system.
• Does your organisation qualify as a small or medium-sized enterprise, including start-ups (Article 3(14a))?: this answer only counts while headcount, turnover band and balance sheet band are missing from the organisation profile. Once the figures are recorded, the derived size class takes the lead.

After Yes to your own development and No to the financial institution, the question appears whether another EU law already requires your organisation to run a quality management system. After Yes you choose between Include in the existing system and Run a separate system for AI, followed by the Which of these EU legal acts apply to your products? card with the Annex I acts grouped into Section A and Section B. The selection pre-fills the Annex I question per system in the classification.

Save the context

Save & Continue checks that at least one issue and at least one interested party are selected, publishes the context and opens the Scope page. Save as Draft stores the state without validation. The figures under the chapter row in the overview then show the number of context topics and interested parties.

Select the organisational areas

The Scope of the AI Management System page lists the Entities, Locations and Departments from the organisation profile in the Organisational areas in scope card. Every entry starts in scope. Untick every area where no artificial intelligence is selected, approved, used or operated. As soon as an entry is deselected, the Reason for exclusion from scope… field appears below it; the text goes word for word into the exclusions section of the scope statement.

Reasons hold up when they say why no AI occurs there or who is responsible instead, for example “Warehouse-only site, order picking without software-supported decisions”. The AI scope may be narrower than that of the ISMS; when in doubt, include an area, because an overlooked department with AI costs you a blind spot.

Record interfaces and dependencies

The Interfaces and dependencies card is collapsed; a click on its header opens it. It carries five categories: AI providers and GPAI models, Cloud inference and hosted AI services, Data suppliers and training data sources, Processors and service providers and Authorities and market surveillance. Clicking a category expands it and offers three ways to a register entry:

• From the register: link matching entries of your asset register with a click; a green badge on the category header counts the matches.
• Quick add: create well-known providers and bodies from a template with one click, such as OpenAI or Mistral AI among the AI providers, IONOS under cloud inference, the BSI or the AI Office among the authorities.
• The Name a provider or service field: type a name and confirm with Enter or the plus icon to create a new register entry. Link asset additionally opens a selection of matching entries from the asset register.

Anything that fits no category you add via Add your own interface with a name and a note. The in RoPA marker shows that an entry already appears in a processing activity.

Generate the scope statement

Under Scope statement sits the AIMS Scope Statement card. Choose the language of the document with the flags and click Generate Document. The generator draws on three sources: the selection and interfaces of this page, the issues, parties and profile questions of the context page, and the size class and organisation name from the profile. Read the text and add to it in the editor wherever your organisation has specifics.

Once a language has content, Regenerate stands in the same place; after the confirmation Yes, regenerate it replaces the entire text of that language, your additions included. Changes to the selection above do not flow into a generated text by themselves. Finish the selection and interfaces first and the fine-tuning of the text last. The editor has no buttons of its own on this page; saving happens through the footer.

Set up the annual review

The Annual review of the scope statement card below the document creates the date the statement promises in its last chapter. Check Reminder date & time and the Recipients; the person from the AI Officer row of the AI roles is pre-selected. While that row is still empty, your own account is pre-selected instead. Set reminder (yearly) creates the recurring reminder immediately, independently of the footer. Afterwards the card shows the next date and the notified persons; Set up again adds a further reminder next to it.

Save the scope

Save as Draft stores the selection, the interfaces and both languages of the editor without publishing anything. Save & Continue publishes the same state, creates a version of the AIMS Scope Statement for each language with content, and returns you to the chapter overview. The version sits under Documentation → Policies & Procedures for review and approval; an empty editor creates no document. You mark the document as complete later on the Policies & Documents page using Complete.