How to Track EU AI Act Findings to Closure

Registering and classifying systems produces findings. A finding on its own changes nothing: it needs someone to own it, actions with dates and a record of the evidence that closed it. VDF AI Compliance keeps all three in Risks & Actions.

We continue with Example Ltd’s CV screening assistant, classified as high-risk in the previous lesson, with two gaps in the register: no Article 11 technical documentation and no Article 14 human oversight specification.

Step 1: See where findings come from

Open Risks & Actions from the Compliance sidebar. Its own description says what feeds it: EU AI Act findings from classification, repository scans and gap reports.

Ours held one finding, created by the classification: Example Ltd CV screening assistant classified as high risk, citing Annex III point 4, severity High, status Open. The three systems classified as limited or minimal risk created no findings. Filters at the top narrow the list by system, severity and status, which starts to matter once the list is longer than one screen.

Step 2: Open the finding and set its status

Choose the finding to open its panel. It repeats the classifier’s rationale, then offers five statuses: Open, In progress, Mitigated, Accepted and Withdrawn.

Set a status that describes what is actually happening, not what you hope will happen. Work on Example Ltd’s finding has started, so we chose In progress.

Step 3: Add actions with a priority and a date

Under Add action, each action takes a title, an optional description, a priority from P0 — critical to P2 — normal and a due date. We added one action per gap:

Each action then carries its own status, Todo, In progress, Done or Blocked, and records when it was last updated. Title actions by what will exist when they are done, not by the activity: “Specify human oversight for every shortlist” can be checked; “look into oversight” cannot.

Step 4: Say what evidence closes each action

Use the description to name the evidence. Ours read:

• Documentation: Article 11: generate the technical documentation in the Document Generator, then have the system owner review and approve it.
• Human oversight: Article 14: a recruiter reviews every proposed shortlist and can override it before any candidate is rejected. Record who reviews and how.

Naming the evidence up front stops an action being closed by activity alone. The next lesson generates the documentation draft, and shows why a generated draft is the start of the first action rather than its end.

Step 5: Close the gap when the evidence exists

Register gaps close from the register, not from Risks & Actions. When the system owner has approved the technical documentation, open the system in AI System Register, choose Edit and tick Has Art. 11 documentation.

We tried it to see the effect: the Gap Report count dropped from two to one, leaving only the missing oversight specification.

Then we unticked it, because Example Ltd’s documentation was still a draft. The flag is a statement that approved evidence exists. Ticking it early makes the gap report say something untrue, and the gap report is what people will trust.

Step 6: Decide when a finding is finished

A finding is finished when every action is done and its evidence exists. Then set the finding to Mitigated. Use the other two statuses deliberately:

• Accepted records a decision to live with a risk rather than reduce it. Record who decided and why in the description.
• Withdrawn is for a finding that turned out to be wrong, for example after a reviewer changes a system’s classification.

Review open findings on a fixed rhythm, such as a monthly governance meeting, starting with anything Blocked or past its due date.