Two standard reactions to the EU AI Act: freeze every AI initiative until legal says otherwise, or commission a thick report that goes stale in a drawer. Neither ships anything. We treat the Act like any other requirements document: break it into backlog items with owners and acceptance criteria. The tickets are the same whether the buyer is a manufacturer or a municipality.
The tickets
Build the inventory. Every organisation has more AI in use than its diagram admits: a vendor feature that became "AI-powered", a script a team relies on, a model inside a machine. One list, with an owner, a purpose and the data it touches. A no-blame rule, or the AI staff already lean on stays hidden.
Classify per system, and write the reasoning down. Prohibited, high-risk, transparency obligations, or below, judged on actual use rather than the vendor's marketing. The written reasoning is what a regulator, an auditor or your successor will ask for. Each classification gets an owner and a review trigger.
Make the pipeline emit its lineage. Lineage in a spreadsheet is wrong within a quarter. Every training run records which dataset version went in, which transformations ran and which artifact came out. Model cards are files in the repository, regenerated on every run, so the evidence is a git log away.
Audit logging a regulator will accept. For each in-scope decision: input, output, model version, timestamp. Append-only, retained per schedule, with human-oversight events logged with the same care. Cheap to build early, painful to retrofit.
Evidence produced as you ship
Done this way, compliance becomes a property of the pipeline. Every training run updates the model card, every deployment extends the audit trail, every architecture change re-triggers a classification review. The evidence pack is a byproduct of shipping, not an excavation after the letter arrives.
A compliance requirement that never becomes a ticket never becomes true.