AI Act / DORA Controlled Definitions Checklist

What Is Inside

The 9-step checklist — from finding your current source of truth to flagging workflow risk, covering ownership, change control, active-usage search, and evidence export.
Minimum term watchlist — the AI Act and DORA starter terms most teams need controlled first, from provider and deployer to ICT-related incident and register of information.
The 10-minute workflow test — six questions that show whether your problem is the definition list or the control workflow around it.

Operational checklist, not legal advice. Verify legal interpretation and current obligations with counsel before using it as audit evidence.

Get the Full Checklist

Enter your work email and the complete checklist unlocks on this page — no download, no signup.

Please enter a valid email address.

Used only for one optional follow-up about the checklist. No newsletter, no marketing list.

The Checklist

Find the current source of truthWhere do approved definitions live today: Excel, Google Sheets, Confluence, SharePoint, CLM, risk register, AI inventory, vendor-management tool, policy template, or nowhere controlled?
List shadow copiesNote every second copy that teams actually use: spreadsheet exports, contract playbooks, Jira tickets, onboarding docs, vendor questionnaires, board packs, and policy pages.
Anchor each term to a sourceCapture term name, regulation or internal source, article/section, approved wording, source link, and any business explanation as a separate non-legal field.
Do not collapse source-specific meaningsTerms like “provider”, “deployer”, “ICT service”, “critical function”, “incident”, or “subcontracting” may mean different things in different legal contexts.
Assign ownershipRecord legal owner, operational owner, reviewer, approver, approval date, and next review date.
Control changesUse draft → review → approved → deprecated. Keep old versions, require change reasons, and avoid self-approval for high-risk terms.
Search active usageCheck approved terms, synonyms, and deprecated terms across AI governance policies, AI intake forms, model/system docs, DORA ICT contract templates, vendor questionnaires, incident playbooks, risk registers, Confluence, and Jira.
Keep evidenceBe able to export current wording, source references, approval chain, change history, unresolved deprecated-term findings, justified exceptions, and last review date.
Flag workflow riskTreat manual screenshots, anonymous spreadsheet edits, no owner, no review cadence, or inconsistent wording between legal/product/security as a control gap.

Minimum Term Watchlist

AI Act starter terms AI system, provider, deployer, importer, distributor, product manufacturer, authorised representative, high-risk AI system, general-purpose AI model, intended purpose, substantial modification, post-market monitoring.

DORA starter terms ICT service, ICT third-party service provider, critical or important function, ICT risk, ICT-related incident, major ICT-related incident, subcontracting, termination right, audit right, register of information.

Use the official legal source as the anchor. Add internal explanations only as separate commentary.

The 10-Minute Workflow Test

Pick one AI Act term and one DORA term. For each, ask:

Where is the approved definition?
Who approved it?
What source does it cite?
What changed since the previous version?
Where is old wording still used?
What would we export if an auditor, client, or board member asked tomorrow?

Reading the result: If the team cannot answer these in 10 minutes, the problem is not the definition list. It is the control workflow around the list.