In Cenedril you build an AI management system for the use of third-party AI with AI Express for the EU AI Act by opening the card of that name on the AI overview and working through eleven compact steps: from the deployer check via organisation, tools and classification to risks, policies, operations and wrap-up. In every step Express brings proposals that you confirm or adjust. At the end, the AI register, classifications, documents and follow-up tasks are in Cenedril, and high-risk systems are noted for the full assistant.
Start Express
Open AI Express
In the sidebar open Wizards, select Artificial Intelligence and, on the AI overview, the card AI Express for the EU AI Act. The first step, Overview and deployer check, lists under What you end up with the building blocks Express creates and marks the boundary under What Express does not do. Provider obligations stay with the full assistant; three actions stay with you: having the leadership commitment signed, approving the generated documents and having the assigned training completed.
Answer the deployer check
Under Do you develop AI of your own? choose one of the two tiles. We use AI that others provide applies to purchased tools and AI features in existing software that you use as delivered. We develop, modify or market AI makes you a provider: the footer then shows Go to the full assistant in place of Next, and Express ends here. The answer is mandatory.
Navigate with the footer
The navigation sits at the bottom of every page. Next saves the step and opens the following one. Save progress remembers where you are. Back appears from step 2 onwards. The progress bar at the top shows Step n of 11 with the step’s name. On the next visit Express resumes at the step you last visited.
Record the organisation and tools
Confirm the organisation's key facts
The step Organisation, context and scope shows under Basic information the entries that already exist from the ISMS or the data privacy assistant. Answer the question Is your organization part of a corporate group (Konzern)?, check Company name, Legal form, Number of employees, Annual turnover and Balance sheet total, and select the Industry. Under Offices & locations Express needs at least one office with a country, under Departments the units that belong to the scope. Industry and office are mandatory.
Number of employees, turnover and balance-sheet band together yield the size class, on which the reliefs of the Regulation depend. The country of the first office determines the market surveillance authority in step 10. Next silently creates the scope statement of the AI management system from these entries as a document awaiting approval; you see it in step 11 and on the documents page.
Select AI tools
The step Record AI tools asks Which AI do you use? and shows tiles from Cenedril’s tool catalogue. The group Generative AI (LLM, image, video, audio) is open; all other technology types sit in folds whose header shows a logo preview. AI features inside existing software are behind the fold AI inside software you already use. If the base product is already in your asset register, the tile appears at the start of the list and carries the badge “… is recorded as a related system”; an AI system that is already recorded carries Already recorded and stays selected.
Click every tile that people in your organisation work with; the line n tools selected keeps count. For some templates the field Enter manufacturer appears after selection and has to be filled before you continue. If a tool is missing from the catalogue, enter it in the Other tile of its group under Enter your own name; this creates a purchased system of that technology type, and you add vendor and description later in the asset register. Next turns each selection into an AI system in the register.
Confirm purpose and classification
The step Purpose and classification shows one card per system with the purposes the template already brings and a badge with the risk class. Check the purposes; Show more purposes and Create your own purpose add what is missing. Every system needs at least one purpose.
For sensitive purposes, a list of yes/no questions appears under Follow-up questions for this system, each preset to No. Switch to Yes whatever applies to your use; Show explanation reveals the legal criterion with its reference for each question. Purpose and answers yield the classification under the AI Act: Minimal risk, Limited risk (transparency), High risk or Unacceptable risk. If a system tips to high risk, to a prohibited practice or into the provider role, the card shows an amber note with the reason and the box Some systems need the full assistant appears at the top. Express still finishes the rest of the management system. Next saves purposes and answers and confirms the classification of each system as a record.
Responsibility, risks and controls
Name the responsible people and review the AI policy
The step Roles and responsibilities asks for two people. Under AI officer you name the person who steers the use of AI; under Executive management the member of management who signs the commitment, with E-mail address. Both are pre-filled from the ISMS where entries exist there. Below sits the AI policy as a fully generated document with a language switch and the button Regenerate; adjust the text directly in the editor where your practice differs.
Next gives the AI officer every deployer role nobody holds yet and files the AI policy as a version awaiting approval.
Confirm the risks
The step Risks proposes, for each technology type of your systems, the relevant scenarios as Threat or Misuse, each with a ready rating. The switch Risk scale shows whether the Standard AI matrix or the ISMS scale applies. Untick scenarios that do not fit your use, and open the sliders for Likelihood, Impact and Severity for affected persons with Adjust assessment where your situation differs. The Risk matrix below summarises the distribution. At least one scenario must stay selected.
Review controls and residual risk
The step Controls and residual risk lists under Applicable controls the eight Annex A controls of ISO/IEC 42001 that apply to a deployer; the two provider controls carry provider only and are excluded with a reason. For each scenario the residual risk after controls stands next to the initial value; with the sliders you change Likelihood, Impact and Severity for affected persons of the residual value. Effect of the controls shows total before, total after and reduction, and the Risk matrix: before and after controls shows the movement per scenario.
Next silently creates two records awaiting approval: the statement of applicability and the risk treatment plan; step 11 links both. Back discards changed slider values.
Policies, objectives and operations
Adjust the AI usage policy
The step Policies shows the AI usage policy generated from the tools, people and classifications of the previous steps: approved tools, handling of inputs, checking of outputs, reporting paths. Edit the text in the editor, switch the language if needed or generate it again with Regenerate. Next saves the content of both languages as a version awaiting approval.
Adopt objectives, competence and communication
The step Objectives, competence and communication shows three cards with the status Express default or Already configured. Under AI objectives four duty objectives are preselected; Show more objectives adds others, the Target date applies to all selected objectives, and the Responsible person is the AI officer from step 5. AI competence assigns six competences to the role groups, Communication creates the default rows for deployers. Each card links to its detail page via Open in the full assistant; Refresh re-reads the cards after changes there.
Set operations to default values
The step Set up operations shows six cards: Monitoring and measurement, Internal audit, Management review, Corrective actions, Incidents and reporting paths and Release of new AI services. Each card describes the default Express sets, such as a yearly audit module across all controls and clauses, the yearly management review by management, or the market surveillance authority from the country of the first office. Check the defaults and continue with Next to the wrap-up.
Complete Express
Make the wrap-up decisions
The step Wrap-up summarises the management system and puts four decisions to you; two further blocks are for reference.
- Policy approval: scope statement, AI policy and AI usage policy are awaiting approval. Choose Approve now if you are authorised, otherwise As a task; the responsible person then approves later on the documents page.
- What the express has set up: the balance of steps 2 to 10 with counts and the links Open statement of applicability, Open risk treatment plan and Open documents. It does not hold up completion.
- Accept residual risks: choose Accept now to accept the calculated residual risks as the responsible person, or As a task. If a scenario is above the acceptance threshold, As a task is preselected.
- Systems the express does not cover: appears only if step 4 set systems aside. For each system, the reason and the items to complete are listed, each with Open into the full assistant. A follow-up task for the fundamental rights impact assessment appears for every high-risk system, even where the list holds no such item: Article 27 obliges only certain deployers, ISO/IEC 42001 requires an impact assessment for all other high-risk systems, and the page Fundamental rights impact assessment shows per system which case applies.
- Suggested follow-up tasks: set to Done whatever is already handled or not relevant in your organisation; only tasks on Open are created.
- Leadership commitment: Request now sends the person named in step 5 a signature request, As a task defers the dispatch to the commitment page.
Complete Express
Click Complete express. Cenedril carries out your decisions, creates the selected follow-up tasks under Tasks and takes you to the AI overview. From there you continue in the full assistant; the Express steps stay reachable, and step 11 then shows the completion date.
Result: the AI management system for the deployer is in place. The AI register holds every selected tool with its classification, the risk scenarios carry residual risk and acceptance, scope statement, AI policy and AI usage policy are approved or filed as an approval task in Cenedril, the statement of applicability and the risk treatment plan are created, the follow-up tasks sit under Tasks, the training is assigned, and systems set aside wait with their list of items in the full assistant.