Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
A smaller team may need a simpler process. It still needs to know what its AI product does and who can change it. Proportionality should make the control usable, not make the responsibility disappear.
Design controls a small team can operate
Begin with a single workflow and the risks that matter for that use. Record its purpose, permitted actions and owner. Keep the evidence close to the release process rather than creating a parallel system that only one person knows how to update.
An illustrative small team might use one reviewed decision record, a compact test suite and a rehearsed escalation path. That is a proposed operating approach, not a claim that these three items satisfy every regulatory requirement. Scope and obligations still need assessment.
Automation can help collect repeatable evidence, but someone must decide what the evidence means. A test that runs on every release is valuable only if the team understands the failure condition and responds when it occurs.
Avoid borrowing an enterprise committee structure simply because it looks serious. Three people cannot meaningfully staff nine committees. They can name a responsible reviewer, document conflicts and obtain external expertise where needed.
| Decision | Evidence to request |
|---|---|
| Keep it small | Few records with clear purposes |
| Keep it current | Evidence tied to releases |
| Keep it accountable | Named decisions and escalation |
What to do with this
The useful question is whether the process can actually be followed under normal working conditions. If it requires a fictional organisation chart, it is unlikely to survive the first busy week.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
