Get your organisation ready for the EU AI Act as a deployer, in ninety days
For organisations that use AI made by others: find every system, sort it by risk, switch off what is banned, run high-risk tools properly, and keep the evidence your clients and board will ask for.
- A 21-sheet workbook: 24-practice maturity self-assessment with a gap-to-action plan, AI inventory, prohibited screen, high-risk duties, evidence register and a dashboard with five charts
- Five fillable forms (18 pages): system record and triage, fundamental rights impact assessment, provider questionnaire, human oversight record and incident report
- Brand-ready templates: deployer procedures with six notices, a one-page sign-off memo, 14 contract clause starters, 32 messages and 25 AI prompts
- A 90-day plan as calendar and task board, a 45-minute team briefing and a 14-question knowledge check for your LMS
The EU AI Act Deployer Compliance Kit · Bodhih Pro Kits · 309 by Bodhih Training, trainers to 2,000+ companies since 2008.
What does a company that uses AI need to do under the EU AI Act?
As a deployer: list every AI system and feature you use, confirm your role, screen out prohibited practices, put AI literacy measures in place, disclose chatbots and label AI content, and for high-risk uses follow the instructions, assign human oversight, keep logs and inform people. The EU AI Act Deployer Compliance Kit from Bodhih Training organises this into 90 days.
Want the full free guide first? Read EU AI Act Deployer Obligations: What Companies Using AI Must Do.
You already feel the problem. Here is what it is costing you.
Nobody knows what AI you actually use
Leadership guesses four or five tools. The real number includes features switched on inside software you already have. Without the list, nothing else can start.
The rules read as if they are for someone else
Most AI Act material is written for the companies that build AI. Deployers get a short list of duties that matter a great deal, and little practical help with them.
The timetable moved and the guidance keeps coming
The 2026 amendments changed dates and wording. You need a method that stays stable and one dated place for the specifics.
Clients are already asking
Supplier questionnaires now have AI sections. You need an honest answer and evidence behind it, not a promise you cannot keep.
Picture the next few weeks with the kit open beside you.
Imagine day 90. You open the Dashboard and read it in a minute: nothing prohibited is live, two high-risk systems have named, trained oversight, every chatbot says it is automated, 94% of staff have completed literacy measures for their role, and one evidence item is red with an owner and a date.
As you draft the sign-off memo, you notice it is mostly written already. The decision log says what was decided and why. The evidence register says what you could show tomorrow. The memo asks leadership to sign off your programme, not to believe a claim.
When the next client questionnaire arrives, you answer it from the files rather than from memory. When a vendor ships a new AI feature, the release-notes check catches it and the prohibited screen takes two minutes.
Whether you start with the Self-assessment tonight or the inventory call-out tomorrow morning, open the Start-here map first and give it one hour.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The EU AI Act Deployer Compliance Kit (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: EU AI Act deployer map
The job in eleven steps with the file to open at each, your first hour, your first week, the 90-day plan, the 'Brand it in five minutes' box and where to measure your starting point.
EU AI Act Deployer Workbook
21-sheet master workbook: settings, 24-practice maturity self-assessment with gap-to-action plan, AI inventory, prohibited-practices screen, transparency register, high-risk deployer duties, vendor register, literacy tracker, incident log, evidence register, decision log, RACI, 90-day roadmap, jurisdiction crosswalk, official sources, a dashboard with five charts and traffic lights, a What changed log and a UK/US glossary.
AI Act Business Case Calculator
Six-sheet calculator: your estimates, cost of doing it (year 1 and later years), cost of doing nothing as exposure ranges with low and high chances, a three-year view and a dashboard with two charts.
AI system record and risk triage form
Four-page fillable record for one AI system or feature: what it is, our role (provider, deployer, importer, distributor), the prohibited-practices screen, risk class with written basis, and sign-off.
Fundamental rights impact assessment form (with DPIA link)
Four-page fillable assessment that follows the Act's six required elements, with a scope check (required or voluntary), a DPIA cross-reference, a risk table and the notification and review record.
AI Act provider due diligence questionnaire
Four-page fillable questionnaire to send to the provider of a high-risk or transparency system: 20 scored questions on role, conformity, instructions for use, oversight, logs, data, incidents, changes and Article 50 marking.
Human oversight assignment and competence record
Three-page fillable record for each high-risk system: who oversees it, their competence and training, their authority to override or stop, the override test and the review rule against automation bias.
AI incident and serious incident report
Three-page fillable report: what happened, the serious-incident test, the timed record (pause, tell the provider, authority), and the fix and lessons. Built for deployers.
AI Act deployer procedures and notice wording
Brand-ready procedure starters: inventory and change trigger, role and classification, high-risk use, transparency and labelling, incidents, AI literacy, plus six ready-to-edit notices (chatbot, voice, AI image label, candidate notice, worker notice, explanation reply).
Leadership sign-off memo (one page)
One-page decision memo for leadership or the board: the decision asked for, a where-we-stand table from the Dashboard, what was done, gaps with owners, risks, cost and the sign-off block.
AI Act contract clause starters and vendor letters
14 plain-words clause starters for contracts with AI providers (roles, instructions, logs, oversight, changes, incidents, data use, marking, termination) and 4 vendor letters, for your lawyer to adapt.
AI Act message and notice library
32 ready-to-edit emails, messages and scripts: leadership and board, team call-outs and briefings, workers and their representatives, candidates and clients, vendors and incidents.
Worked example pack: Harbourline People Services, Dublin
The kit's main files completed for one fictional 140-person recruitment and payroll firm: baseline self-assessment, business case, 14-system inventory and triage, the prohibited feature, transparency notices, high-risk oversight, incidents, literacy and the day-90 sign-off.
AI prompt pack for AI Act deployers
25 tool-agnostic prompts grouped by step (inventory, classification, literacy, notices, high-risk use and vendors, incidents and sign-off), each with what to paste in and a human-review rule, plus five standing rules.
45-minute team briefing session plan and knowledge-check answer key
A 45-minute briefing plan (running order, three scenario cards, before and after checklists) and a printable answer key for the 14-question knowledge check.
Risk triage decision card
Three-step if-then card: is it an AI system and what is our role, the nine-question prohibited screen with examples, and the class with the deployer duties that follow.
Twenty mistakes AI Act deployers make
Twenty common mistakes, from counting products instead of features to rubber-stamp oversight, each with what to do instead.
Numbers that matter: AI Act KPI card
14 numbers a deployer programme runs on, each with a plain-words meaning, the exact formula, where it lives and what to do when it moves.
EU AI Act timetable and rules by country (November 2026)
The dated sheet: the amended EU AI Act timetable, key articles for deployers, penalty caps, Ireland's set-up, and the position in the UK, US (Colorado, NYC, Illinois, California), Canada, Australia and New Zealand, with sources.
90-day AI Act deployer programme calendar
40 events: every roadmap task and milestone from kick-off to sign-off, plus a weekly 20-minute check-in. Change the start date to yours. Imports into Google, Outlook or Apple Calendar.
AI Act deployer task board
33 tasks with phase, owner role, due day, priority, the kit file to use and milestone flags. Import into Trello, Asana, Notion, Planner or Jira.
AI Act knowledge check (LMS import)
14 scenario-based multiple-choice questions with answers and explanations, ready to import into Bodhih LMS or any LMS that accepts CSV.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 69 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira, Bodhih LMS and other LMSs
- Best for
- Organisations of roughly 20 to 2,000 people that use AI made by others
Are You in Scope? Roles and Reach
Whether the Act reaches you (including from outside the EU), provider, deployer, importer and distributor, the four ways a deployer becomes a provider, and naming the owner.
Find Every System: The AI Inventory
A no-blame call-out, counting features not products, the 90-minute workshop and the change trigger that keeps the inventory true.
Triage: Sorting Systems by Risk
Four classes and a holding pen, the listed high-risk uses, the narrow exceptions, the profiling rule and writing the basis in plain words.
The Prohibited-Practices Screen
The nine-question screen, why emotion inference at work is the one most organisations find, and switching it off the same day.
AI Literacy That Fits the Role
Literacy measures that fit each role, the 45-minute briefing, a scenario-based knowledge check and attendance records.
Transparency: Chatbots, Labels and Deepfakes
Chatbot and voice disclosure, deepfake and public-interest text labels, the exact words, and checking them live.
Using High-Risk AI Well: The Deployer Duties
The eleven deployer duties for high-risk systems: instructions, oversight that can change an outcome, input data, logs, notices, explanations and the FRIA where it applies.
Vendors, Contracts and the GDPR
A scored provider questionnaire, contract clause starters, renewal timing and how the AI Act and the GDPR DPIA fit together.
When Things Go Wrong: Incidents and Penalties
Incidents and serious incidents, the pause-tell-test-close flow, and the penalty tiers in plain words.
Ninety Days, the Evidence File and Sign-Off
The 90-day roadmap, an honest business case, the evidence register, the re-score, the country crosswalk and the one-page sign-off memo.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-EU-AI-Act-Deployer-Map.pdf: the job in eleven steps with the file for each, your first hour, your first week, the 90-day plan and the 'Brand it in five minutes' box
Workbooks
- EU-AI-Act-Deployer-Workbook.xlsx: 21 sheets including Settings, a 24-practice maturity Self-assessment with gap-to-action plan, AI inventory, prohibited-practices screen, transparency register, high-risk deployer duties, vendors, literacy, incidents, evidence register, decision log, RACI, 90-day roadmap, jurisdiction crosswalk, official sources, a dashboard with five charts and traffic lights, a What changed log and a UK/US glossary
- AI-Act-Business-Case-Calculator.xlsx: 6 sheets comparing the cost of doing it with the cost of doing nothing over three years, using only your estimates
Fillable forms
- AI-System-Record-and-Risk-Triage-Form.pdf: the system, our role, the prohibited screen, the class and sign-off
- Fundamental-Rights-Impact-Assessment-Form.pdf: scope check, the six required elements, a risk table and the notification record, linked to your DPIA
- AI-Act-Provider-Due-Diligence-Questionnaire.pdf: 20 scored questions for providers of high-risk and transparency systems
- Human-Oversight-Assignment-Record.pdf: who oversees each high-risk system, competence, authority, override test and quarterly review
- AI-Incident-and-Serious-Incident-Report.pdf: what happened, the serious-incident test, the timed record and close-out
Word templates
- AI-Act-Deployer-Procedures.docx: six procedure starters and six ready-to-edit notices
- Leadership-Sign-Off-Memo.docx: the one-page decision memo
- AI-Act-Contract-Clauses-and-Vendor-Letters.docx: 14 clause starters and 4 vendor letters for your lawyer to adapt
- AI-Act-Message-and-Notice-Library.docx: 32 emails, messages and scripts
- Worked-Example-Pack-Harbourline-Dublin.docx: the main files completed for one fictional 140-person firm
- AI-Prompt-Pack-for-AI-Act-Deployers.docx: 25 prompts, each with a human-review rule
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute briefing plan and a printable answer key
Cheat sheets
- Risk-Triage-Decision-Card.pdf: role, prohibited screen and class, with the duties that follow
- AI-Act-Mistakes-to-Avoid.pdf: 20 mistakes and what to do instead
- Numbers-That-Matter-AI-Act-KPI-Card.pdf: 14 numbers with formulas and what to do when they move
- EU-AI-Act-Timetable-and-Rules-by-Country-November-2026.pdf: the dated sheet with the amended EU timetable, key articles, penalty caps and the UK, US, Canada, Australia and New Zealand
Calendar, import and LMS
- 90-Day-AI-Act-Deployer-Programme.ics: 40 calendar events
- AI-Act-Deployer-Task-Board.csv: 33 tasks for Trello, Asana, Notion, Planner or Jira
- AI-Act-Knowledge-Check-LMS-Import.csv: 14 scenario questions with answers and explanations for Bodhih LMS or any LMS
E-book
- The EU AI Act Deployer Compliance Kit e-book: about 9,900 words, 10 chapters, 2 appendices and 23 figures
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Decide whether the EU AI Act reaches your organisation and in which role, including from outside the EU
- Build an AI inventory that counts features, not just products, and keeps itself current
- Classify each system with a written basis, and recognise the narrow exceptions and the profiling rule
- Screen every system and new feature for prohibited practices and switch off what matches
- Run role-based AI literacy measures with a 45-minute briefing and an LMS-ready knowledge check
- Put chatbot disclosures, AI content labels and notices to workers and candidates in place
- Meet the deployer duties for high-risk systems with oversight that can change an outcome
- Keep an evidence register and take a one-page sign-off memo to leadership
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Signing It Off: AI Governance Judgment
Take the assessment →AssessAll assessmentArtificial Intelligence Literacy Assessment for Employees in Every Role
Take the assessment →AssessAll assessmentData Governance & Data Quality Stewardship Judgment
Take the assessment →JobularyIf-then plans that make habits stick (Jobulary)
Make it a growth plan →A taste of Chapter 7
Oversight that can change an outcome. Use the Human-Oversight-Assignment-Record. Name the people, record their training, give them written authority to override and to stop, and test the override button before go-live and every quarter. Then watch the numbers: if a reviewer accepts 100% of outputs for months, oversight has probably become a rubber stamp. Harbourline named six recruiters for TalentSift and two payroll leads for the ShiftPoint rating module, who review every low rating before any change to a temp's rebooking. Input data you can defend. For a CV tool this means the criteria you feed it. Are they the job's real requirements? Do any act as a proxy for something protected: career gaps (often caring responsibilities or illness), postcodes, names, particular universities? Harbourline's input data note was still a draft at day 90; it is one of the three practices below target.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Scope and role | Assumes you build AI | Written for deployers, with a role decision tree and the four ways a deployer becomes a provider |
| Inventory and triage | A blank list of tools | A feature-level inventory, a nine-question prohibited screen and a triage card with written bases |
| High-risk use | A summary of the article | Eleven duties per system with owners, evidence IDs, an oversight record and an override test |
| Timetable | Undated, often pre-amendment dates | A dated sheet built on the amended text, with Official Journal and Commission sources |
| Evidence and sign-off | None | A maturity self-assessment, an evidence register with traffic lights and a one-page sign-off memo |
| Compared with a consultant or software | A consultant designs the programme for you; compliance software tracks it at scale | You run the programme yourself with ready files, and bring an adviser in for the borderline calls |
Made for you if…
- Heads of operations, compliance and risk in organisations that use AI tools
- Data protection officers and privacy leads adding AI Act work to the DPIA process
- HR and recruitment leaders using AI in hiring, rostering or performance
- General counsel and in-house lawyers who need an organised programme to advise on
- US, UK, Canadian, Australian and New Zealand firms whose AI output is used in the EU
- Consultants and fractional compliance leads running AI Act readiness for one organisation at a time
Probably not for you if…
- Providers building high-risk AI systems or general-purpose AI models for the market: you need conformity assessment and technical documentation support this kit does not give
- Anyone looking for legal advice, an audit, a certification or a guarantee of compliance
- A general AI use policy for staff: see The AI Use Policy and Governance Kit
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
One owner, ninety days, an evidence file you can show
Open the Start-here map and give it one hour. Whether you begin with the Self-assessment tonight or the inventory call-out on Monday, the next step is small and the file for it is already in the kit.
Personal licence for the buyer's own use, including use within your own organisation and with its staff. Please don't share or resell the files. Team and company licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The AI Literacy Programme Kit
Design, run and evidence a workforce AI literacy programme.
The AI Agent Deployment Playbook
Put AI agents to work safely in a team or small company, tool-agnostic.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The EU AI Act Deployer Compliance Kit: FAQs
Read the free guideAlready bought? Resend my linkDoes the EU AI Act apply to my company if we only use AI tools and don't build them?
Yes, very likely. The Act calls an organisation that uses an AI system in its work a deployer and gives deployers their own duties: AI literacy measures, the prohibited-practices ban, transparency for chatbots and AI content, and a set of duties for high-risk uses such as recruitment and credit scoring of people. This kit is built for exactly that role.
Does the EU AI Act apply to US, UK, Canadian or Australian companies?
It can. The Act reaches providers and deployers outside the EU when the output of the AI system is used in the EU, for example shortlists sent to an EU client or a chatbot answering EU customers. The kit's crosswalk also maps the method to the UK, US states and cities, Canada, Australia and New Zealand, with official sources.
Is using AI for CV screening high-risk under the EU AI Act?
Recruitment and selection, including sorting and assessing applications, is one of the listed high-risk uses. Narrow exceptions exist, but not where the system profiles people, and ranking applicants is profiling. Chapter 3 and the Risk Triage Decision Card walk through it; check borderline cases with your adviser.
What do we have to do for our website chatbot under the AI Act?
People must be told they are dealing with an AI system, at the latest at the first interaction, unless it is obvious. If you configured the bot and run it under your brand, act as if that design duty is yours. The kit includes exact wording, a transparency register and a quarterly live check.
When do the EU AI Act deployer obligations apply after the Digital Omnibus?
Some already apply, including the prohibited practices, AI literacy and the transparency duties; the high-risk duties for listed uses apply later under the amended timetable. The exact dates, with Official Journal and Commission sources, are on the kit's dated sheet, correct at November 2026.
How long does it take to get ready as a deployer?
The kit is planned as a 90-day programme for one owner with a few colleagues: find and sort in the first month, tell and oversee in the second, prove and sign off in the third. The calendar file, task board and Roadmap sheet carry the same thirty tasks.
Can we do this without a consultant or compliance software?
Many organisations can run the programme themselves with this kit, then use an adviser for borderline classification calls, contract wording and anything the kit marks 'check with your adviser'. Software helps at scale; the workbook works in Excel, Google Sheets, Numbers or LibreOffice.
Can I use this with my team?
Yes. The personal licence covers use within your own organisation, including sharing the forms, notices, briefing and knowledge check with your staff. For use across several companies, a group or a consultancy's clients, ask about a company licence at solutions@bodhih.com.
Does it work in my country?
The method works anywhere you use AI. The EU AI Act content applies wherever the Act reaches you; the dated sheet and crosswalk cover the UK, the US (federal, Colorado, New York City, Illinois, California), Canada, Australia and New Zealand. Laws differ and change, so check locally before relying on any specific.
Is this legal advice or a certification?
No. It is an educational toolkit that helps you organise a deployer programme and keep evidence. It is not legal advice, an audit, a certification or a guarantee of compliance, and it is not for providers of high-risk AI systems or general-purpose models. Not affiliated with or endorsed by the European Commission.
How can I measure my own judgement on AI governance before I start?
AssessAll's Signing It Off: AI Governance Judgment assessment asks how you decide whether an AI tool should be switched on for others, and its AI literacy assessment can give you a workforce baseline. Both are at assessall.com.
How do I make the quarterly checks a habit?
Write them as if-then plans, such as 'If a vendor email mentions a new feature, then I open the Prohibited screen before I reply'. Jobulary's guide to if-then plans explains why this works.
How much does The EU AI Act Deployer Compliance Kit cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
