The legal context of AI governance
L1 — Align can help organise evidence, rules and responsibilities. The scope of legislation depends on the organisation’s actual activities and role. A generic document package does not automatically ensure full compliance with every law.
| Area | What to establish first | Detailed guide |
|---|---|---|
| AI Act | Model or system, purpose, role, possible prohibitions, high-risk status and transparency | AI Act |
| GDPR | Personal data, purpose, legal basis, controller or processor role and processing risks | GDPR |
| Cybersecurity | Regulated service and regime under Czech Act No. 264/2025 Coll., effective from 1 November 2025 | NIS2 and Czech law |
| Data Act | Role concerning connected-product data or a data processing service, and the specific contract | Data Act |
| DORA | Scope and role of a financial entity or third-party ICT service provider; relevant ICT risks and supplier relationships | DORA |
Connecting legal requirements with practical work
An inventory helps identify systems and purposes. Rules guide behaviour, training develops relevant knowledge, and incident procedures allocate response and notification tasks. Each material should state the specific obligation or internal need it supports.
The law generally does not prescribe our template names, a quiz question count or a universal set of nine documents. Classification, technical documentation, DPIAs, human oversight and conformity assessment each have their own conditions. For a high-risk system, the conformity assessment route follows Article 43 and the applicable regime; an independent notified body is not required for every use.
Workplace rules must reflect employment obligations, actual authority and clear employee communication. Employee monitoring and significant automated decisions require particular assessment.
Dates and changes
Use the regulatory timeline for current dates. Do not rely on one general “AI Act applies” date: different duties have different application dates and transitional provisions. Under Czech cybersecurity law, some deadlines run from the registration decision.