Sales
Sales wants a yes this week, and no single record shows which AI systems serve that customer.
HR
The review has no owner yet, and hiring is a use the new AI laws single out.
Outside counsel
Those facts sit with the model’s owners, so legal pieces them together by email.
How it works todayWhat it needs to be
- How it works today
Legal hears about AI when someone forwards it
What it needs to beLegal named on the reviews that need it, before anything ships
- How it works today
Approvals and conditions agreed by email
What it needs to beEach decision kept with its conditions, approver and date
- How it works today
New laws tracked in a spreadsheet
What it needs to beEvery system assessed against the rules that reach it
- How it works today
Advice given at launch, then filed
What it needs to beRevisited as uses widen, models change and duties start
Will legal end up keeping another system up to date?
No. The people who own each AI system keep its record current: its purpose, where it’s used, its owners, and the vendor and models behind it. Legal reviews only where it’s named as a reviewer, and each request reaches you by email when it’s your turn. You keep advising, without rebuilding the facts for every question.
Where does this leave our privacy and contract tools?
Right where they are. Enzai sits alongside them and keeps the AI side of the record: each system, its vendor and models, its assessments and who signed off. Assessments export as internal or external reports, so you can file them wherever your other records live and share only what you choose.
Will it make legal calls that should be ours?
No. Your team makes each classification, under the EU AI Act, a framework you build for a state law or your own policy, and Enzai sets up only the controls that classification calls for. Which laws reach you stays a legal call, and the reasoning and the sign-off stay with you, on the record.
What does Enzai hold about our people and our data?
The governance record: systems, purposes, owners, assessments, decisions and the documents your team attaches. A model import adds the model’s details, not the data it runs on. AI discovery, if you turn it on, counts AI use without naming anyone, and prompts aren’t sent to Enzai unless you choose to share them.
With the laws still moving, should we wait to start?
The record you need doesn’t move with the dates: which AI you run, where each system is used and who owns it. Start there, then assess the systems used in hiring, lending or customer decisions against the EU AI Act or a framework you build. When a framework is updated, you choose when each system switches.
Will the record hold up with a regulator or a customer?
It gives you a record to show, not a verdict. Export an assessment as an external report for a customer’s due diligence, and each request downloads with every decision, condition, approver and date. Conditions are recorded, not enforced on their own, so set a matching control where one needs a technical block.
Where to start
