Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
A framework can give several teams a common language. It cannot establish that their systems have the same risks. Reusing a template is efficient; reusing an unexamined conclusion is something else.
Reuse the structure, reassess the use
Two assistants can share a model while serving very different purposes. One summarises public material. Another helps staff evaluate sensitive applications. Their users, affected people, data and consequences differ, so the assessment needs to reflect those differences.
A reusable record can ask consistent questions without forcing identical answers. Include the intended use, deployment context, permissions and evidence. Let the reviewer see where the new system differs from the previous one.
An illustrative template might carry forward a supplier’s model documentation while requiring a fresh assessment of the tool permissions. The supplier evidence describes one part of the system. It does not automatically describe the workflow built around it.
When a shared component changes, identify which deployments rely on it. That dependency map helps the team decide where evidence needs refreshing. Without it, “we use the approved model” can become a shortcut that hides important local changes.
| Decision | Evidence to request |
|---|---|
| Reuse | Relevant component evidence |
| Reassess | Purpose, people and permissions |
| Propagate changes | Affected deployments and tests |
What to do with this
Standardisation should make differences easier to see. If the template makes every deployment look identical, it is probably hiding the information the review needs most.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
