Evidence of due diligence for AI. Six steps before the first question

Evidence of due diligence for AI is the set of documents and records with which an organisation shows that it knows where it uses artificial intelligence, on what terms, and who is accountable for it. Compliance you cannot show does not, in practice, exist - what counts is what you can pull out of the drawer when someone asks.

Below are six steps, control questions for each, and the list of documents this work should leave behind.

Why now?

From 28 October 2026 Poland runs a national route for filing complaints with the Commission for AI Development and Security. A natural person, a legal person or an organisational unit may file one, on the basis of Article 85 of the AI Act and the Polish act on artificial intelligence systems. That changes the practice: a question about AI no longer has to come from a planned inspection, one report from a client, a competitor or a former employee is enough. We wrote about the authority itself in the article on KRiBSI.

Step 1: Who will ask - and about what exactly?

Before you start collecting paperwork, work out who it is for. Each asker expects something different.

Control questions: Do we know who in the organisation receives such a question and who they pass it to? Are clients in tenders already asking us about AI usage rules? Has a counterparty's procurement team sent us a supplier questionnaire? Does an employee know where to raise a doubt about a tool?

In practice the first question usually arrives not from an authority but from a supplier questionnaire or a tender - and the response window tends to be shorter than in proceedings.

Step 2: The register - do we know what we use?

Without a list of tools, no other document has anything to attach to. The register is the foundation of the whole set.

Control questions: Does the AI system register also cover tools used informally? Does every entry have an owner, a purpose of use and data categories? Is the date of the last review visible? Have we recorded, for each system, whether we are the provider or the deployer?

A register with no review date proves only that it was created at some point.

Step 3: Training - who, when and with what result?

The AI literacy obligation in Article 4 of the AI Act has applied since 2 February 2025. The evidence is not that training was organised, but a named record of who completed it.

Control questions: Do we hold a list of people with completion dates and results? Can we point to who has NOT taken the training? Do new joiners take it during onboarding? Does the scope match people's roles rather than being identical for everyone?

That last question decides how credible the set looks: identical training for the accounts team and for the team deploying models is hard to defend as appropriate.

Step 4: Rules and acknowledgements - do people know them?

A policy without acknowledgements is an internal document, not evidence. Its value appears only alongside the signatures.

Control questions: Does the AI usage policy list approved tools and a route for proposing new ones? Have employees confirmed reading it, and did we record that? Does the policy carry a version and a date? Does anyone review it after the tools change?

Without versioning there is no way to answer which rules were in force on the day of an incident.

Step 5: Decisions - can you see why this and not that?

The weakest link in most sets. Organisations hold documents but hold no record of the reasoning behind them.

Control questions: Did we write down why we approved one tool and rejected another? Does the risk classification show reasoning rather than only a result? Does every decision carry a date and a person? Can we reconstruct what we knew at the time we made it?

This record is what separates an organisation that weighed the risk from one that never noticed it - and Article 99(7) of the AI Act lists among the circumstances weighed the degree of responsibility of the operator, taking into account the technical and organisational measures implemented.

Step 6: The set and its review - what should remain?

After this work the organisation should hold one place containing:

• the AI system register with a change history and review dates;
• the AI usage policy with a version number and acknowledgements;
• named proof of training completion with results;
• decisions to approve and reject tools, with reasoning, date and person;
• documentation of risk classification and vendor assessments;
• a record of the periodic review, and a named owner of the set.

Without that last item the set ages within months, because tools change faster than documents do.

What this evidence does not settle

The assembled set is not a guarantee of AI Act compliance, nor a promise that no fine follows. Article 99(7) states plainly what the authority weighs: the nature and gravity of the infringement, the size of the operator, the degree of cooperation with the authority, the technical and organisational measures implemented, and any action taken to mitigate the harm. Evidence of diligence bears on several of those items, but it does not replace them and does not settle the outcome of proceedings.

On your own, or with a tool?

The six steps above can be taken with a spreadsheet and a folder on a shared drive. The difficulty is not in assembling the set but in maintaining it: people join, tools change, the policy needs another version, and acknowledgements have to be collected again.

That is exactly the problem the AI TrustCERT platform solves: the register, policies with acknowledgements, training with certificates and a record of decisions in one place, with a change history. If you want to see where to start, the AI Ready Check gives a preliminary reading in three minutes, and the full sweep is described in our article on the EU AI Act compliance audit.

Summary

Evidence of due diligence comes down to six questions: who might ask, do we have a register, are people trained and can we show it by name, are the rules acknowledged in writing, do decisions carry reasoning, and does anyone review the whole thing.

From 28 October 2026 anyone may complain about an AI system in Poland - a natural person, a legal person or an organisational unit. An organisation with the set ready in advance answers in days. An organisation that starts assembling it after the question arrives answers with whatever it manages to reconstruct.

Documents do not come into being retroactively - at least not ones that hold up.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.