In Cenedril you set up the Rules, competence & implementation chapter of the AI Compliance Assistant by generating and publishing the AI usage policy, setting the expected competence per role group in the AI competence matrix, filling the communication plan with audiences and required documentation, and turning the applicable controls into tasks. The four pages read what you recorded in the earlier chapters: organizational context, AI roles, classified systems and risk treatment. At the end the policy sits in your documentation, the training modules are assigned, and the implementation is on the task board as tasks.
Open the chapter
Open the chapter intro
Open the overview of the AI Compliance Assistant and click the row Rules, competence & implementation. The chapter intro explains why rules of use, competence and implementation belong together and names the pages of the chapter. Next leads to the first input page, the AI usage policy; Back returns to the overview. The progress bar at the top also takes you straight to any page of the chapter.
Generate and publish the AI usage policy
Check the responsible person
The AI Usage Policy page shows the person responsible for this policy above the editor. It comes from the AI policy row of the AI roles; as long as that row is empty, the AI officer applies. If the name is missing, the link to the AI roles takes you there. Generate the draft only once the organizational context, roles, inventory and classification are in place: whatever is missing at that moment is also missing from the text.
Generate the draft
Use the flags to choose the language of the document. As long as the editor of the chosen language is empty, Generate Document appears; Cenedril assembles the text from the organizational context, the AI roles and the AI register (tool names, chapters per role and classification, notes naming the responsible people). After that, Regenerate replaces the entire text of that language after a confirmation, your own wording included. Neither saves anything yet; the text lives in the editor until the footer takes it over.
Adapt the text
Three passages of the draft almost always need your hand: the data classification terms (align “confidential” and “classified” with your information security policy), the approval of AI-generated content before publication (who reviews, how it is labelled), and the reference to a disciplinary procedure for violations. You change these passages directly in the editor. Where an employee representation exists, clarify its involvement before the policy takes effect.
Set up the annual review
Under Annual review of the AI usage policy you create the recurring reminder. The recipient list is prefilled with the people from the AI policy row, otherwise with yourself. Set reminder (yearly) creates the reminder at once, independent of saving the page.
Create the release process for new AI services
The block Release of a new AI service below the editor implements the policy’s rule that a new service goes live only after approval. It runs through the phases Request, Screening, Statements, Decision and Entry into the inventory. Expand each phase and assign at least one person to its role (Requester, AI officer, Privacy and security function, Approver, IT); people from the AI roles carry the RACI mark. Required fields such as Name of the service, Intended purpose, Check for prohibited practices (Art. 5) and Decision are fixed; the other fields you tick on or off. Under Who can create tickets? leave All (everyone can create tickets) set so that every employee can request a service. Create process becomes available once every role is staffed; afterwards the block shows Workflow active and the link Open in Workflow Admin.
Publish the policy
The footer is the save path of this page. Save as Draft stores the editor content of both languages without publishing anything. Save & Continue publishes it, creates one version per language with content under Policies & Documents and leads to AI Literacy & Training; an editor that is empty in both languages is rejected. You set the completion mark later under Policies & Documents with Complete.
Set the AI competence matrix
Review the matrix
The AI Literacy & Training page shows the AI competence matrix: the rows are the role groups All employees, AI Officer, Human Oversight, AIMS Operation, AI Competence and Risk & Impact Assessment, the columns the six AI competences from AI literacy basics to Perform impact assessments. The people under the role groups come from the AI roles; anyone missing is added there. The suffix (no user account) after a name means that this person cannot receive the training modules in Cenedril. Hovering over a column header shows what the competence covers.
Adjust the assignment
On the first visit a proposal is already in the table. Clicking a cell sets or removes an assignment. Pale cells come from the All employees row and cannot be deselected in the role row (hint Assigned via “All employees”). To limit a competence to specific roles, first remove it from the baseline and then set the individual roles. When in doubt, tick the box: an assignment that is too broad can be taken back in the next round, while a gap shows up in the audit.
Plan the competence review and publish the matrix
Under Annual competence review you set the recurring reminder; the people from the AI Competence row are prefilled. Save as Draft keeps the ticks without triggering anything. Save & Continue publishes the matrix, assigns the training modules and leads to Communication: AI Fundamentals & Safe Use goes to every user account of the organisation, Operating AI Systems & Human Oversight to the people in the Human Oversight and AIMS Operation rows and, once the organisation is the provider of a high-risk system, Provider Obligations for High-Risk AI to AI Officer and AIMS Operation. The assignment follows the published state of the roles; if the roles page still carries a draft, a note above the matrix says so.
Define the communication plan
Go through the preset rows
The Communication page comes filled with 13 preset rows. They cover internal communication (AI policy, usage rules, annual AI literacy, report to top management, changes to a system, notification after an incident) and the outward-facing duties under the AI Act (transparency information, informing workers before putting a system into use, incident reporting, requests from authorities, supply chain, withheld or suspended systems, usage limits for customers). Rows that apply only to organisations placing AI systems on the market themselves you remove with the bin icon Remove; a deleted preset row does not come back after saving. Add your own events with Add communication event.
Fill in a row
Per row you set Frequency and Channel / method, pick the interested parties from the organizational context under Audience via Add audience (the free-text field below stays as a supplement), determine under Documentation needed via Add documentation which documentation this audience requires (Other opens a free-text field), and choose the Responsible person from the people in the asset register. The Content / key messages field goes word for word into the generated communication plan; add system names and the contact point for questions there. Two amber notes below the rows list recorded parties without a row or without documentation; they block nothing.
Set reminders
First secure the rows with Save as Draft, then open Set reminder on each row. The reminder is created at once; the repetition follows the row’s frequency, and rows with On occurrence or Other get a one-off reminder. The responsible person of the row is prefilled as long as their entry is linked to a user account. Under Annual review of the communication plan at the bottom of the page you additionally set the reminder for maintaining the plan as a whole; the AI officer is prefilled there.
Publish the plan
Save & Continue checks the required entries (per row a topic, an audience, a frequency and a channel), publishes the plan and leads to Implement controls. An empty row that was added blocks publication; delete it in that case. You generate the AI Communication Plan document later under Policies & Documents and approve it there.
Implement the controls
Review the list of controls
The Implement AI controls page lists the applicable AI controls under the themes Organisation, System and Information, followed by the card Additional EU AI Act obligations. Which controls appear is decided by the risk treatment: a control is listed as soon as at least one AI system carries it and it was left without an exclusion there. Each card names the systems under Applies to and, under Also covers EU AI Act, the obligations of the regulation that overlap with it. If the list stays empty, the selection in the risk treatment is missing.
Open a group and tick criteria
Expand a control. Inside are groups numbered A.x.y, the controls from Annex A of ISO/IEC 42001; on the right of the group header a row of dots and a status label (Open, In progress, Done) show the state. In the expanded group each criterion is stated as an action with a checkbox and the Implementation guidance (how-to, subtasks, roles, effort). Many criteria carry a link badge Fulfilled through … that points to the place in Cenedril where the criterion is produced; the tick sets itself there as soon as all systems are covered. Every tick, every click on a badge and every deselection is saved as a draft immediately.
Deselect control points that do not apply
With Control point not applicable you take a criterion out of the count, the dot row and the task. The Exclusion reason block appears below with a selection (for example Concerns a role the organisation does not hold) and a text field. Without a chosen reason the exclusion carries no evidence in an audit; nothing is blocked. Criteria with the reference Deselected in risk treatment are taken back only there. The card Additional EU AI Act obligations has no deselection; there, applicability follows from the classification.
Create a task for a group
As long as a group has no task, it shows the field Implementation responsible, the Priority selection (Normal, High, Very high) and the button Create task for this control below the group header. Set person and priority before you click: both are taken over at the moment the task is created and can be changed afterwards only in the task itself. The person needs a user account, otherwise the task goes to you. The task carries control and group in its title, the criteria as a checklist and the implementation guidance per checkpoint. Afterwards the group shows only Responsible, Task created on and Priority, and the ticks here and in the task stay in sync.
Publish the implementation
Back returns to Communication without saving. Save as Draft stores all ticks, badges and deselections in one go. Save & Continue publishes the state and leads to the AI overview, from where the Evaluation & Improvement chapter begins.
Result: the AI usage policy sits as a version under Policies & Documents, the release process for new AI services is active, the competence matrix is published and the training modules are assigned to the user accounts. The communication plan carries an audience, documentation and a responsible person per row, and every control group with a task is on the task board with a checklist, a responsible person and a status. The AI overview counts the ticked criteria as Planned measures.