L1 — Align outputs
L1 — Align helps turn AI use into an inventory, practical employee rules and a plan for further work. This page explains the purpose of the materials. The chosen variant and confirmed offer on the L1 — Align page determine the exact list, formats, review scope and handover arrangements.
What the materials should clarify
| Material | Decisions it supports | What the organisation supplies or approves |
|---|---|---|
| AI inventory and initial scope assessment | Which systems are used, why, and which questions require specialist assessment | Actual systems, suppliers, roles, data and purposes |
| Acceptable use rules | Which tools employees may use, with which data, and who approves exceptions | Approved tools, responsibilities and the rules themselves |
| Data classification and quick reference card | Which information may enter a particular tool and when advice is needed | Data categories, contractual restrictions and security requirements |
| New-tool approval process | Who assesses purpose, risk, contract and technical conditions | Process owners and approval authority |
| Incident procedure | Where an employee reports a problem and who assesses further notification | Contacts and links to IT, privacy and crisis management |
| Training materials and checks of understanding | How employees learn the rules relevant to their work | Participants, practical examples, records and follow-up learning |
| Findings and follow-up actions | What is complete, what remains open and who will address it | Action owners, priorities and decisions on acceptable risk |
Who prepares the material and who decides
Agree who gathers inputs and coordinates feedback. Identify who decides on tools, rules, budget and exceptions. One person may hold several responsibilities in a smaller organisation.
A consultant can lead assessment and prepare proposals. People in the organisation verify the actual situation, supply missing information and approve the rules and next steps. At handover, record owners of open actions and the review date.
Legal duties and ways of supporting them
Neither the AI Act nor GDPR prescribes a universal document set called P1–P5 or T1–T4. Policies and training can support measures to promote AI literacy under AI Act Article 4; the law does not prescribe a slide count, quiz format or pass mark. GDPR requires appropriate organisational and technical measures, not a universal four-level data classification scheme.
Assess incident reporting separately: by role and risk under GDPR, by regulated service under cybersecurity law, and by system type and role under the AI Act. AI Act Article 73 primarily governs serious incident reporting by providers of high-risk systems, subject to the relevant application dates. Article 62 concerns support measures for providers and deployers, especially SMEs including start-ups, not a general incident reporting regime.
What makes a handover useful?
- The materials reflect the organisation’s actual tools and processes.
- Preliminary findings are clearly distinguished from approved conclusions.
- Every open point has an owner and next action.
- The organisation knows where current versions are stored and when to review them.
- Any legal opinion, technical deployment or independent certification is explicitly scoped as separate work.
A document, export or questionnaire result alone is not organisational certification or a guarantee that all AI systems comply with applicable requirements.
Legal references verified on 6 September 2026: consolidated AI Act, GDPR.