Most AI Governance Is a Slide Deck. Real AI Governance Is a Register Someone Owns.
Most AI governance programmes have a policy. Real AI governance programmes have a register — a living record of which use case sits in which risk tier, which obligation is still open against it, and who is on the hook for closing it. A policy document tells a board what should happen. A register tells a board what has actually happened, line by line, and it is the second one that survives contact with a regulator.
Executive Summary
Four bottlenecks that stall every AI compliance programme
- No consistent classification — different teams apply different judgement calls to the same category of use case, with no shared reference point.
- No obligation-level tracking — High-Risk obligations exist in a policy binder, not in a register anyone is actively closing out.
- No exposure quantification — unmet obligations carry real financial and enforcement risk that rarely reaches a board as a single figure.
- DPDP treated as a separate process — India's Digital Personal Data Protection Act runs in parallel to the EU AI Act, yet most programmes assess the two frameworks in disconnected workstreams.
The Waterfall Is the Whole Argument
The EU AI Act (Regulation (EU) 2024/1689) sorts AI systems into four tiers — Prohibited, High-Risk, Limited-Risk, and Minimal-Risk — and it checks them in that exact order. Prohibited is tested first and cannot be bypassed. Only once a use case clears Prohibited does the framework test High-Risk. Only once it clears High-Risk does it test Limited-Risk. Everything left over defaults to Minimal-Risk.
That's not a checklist. It's a waterfall — and the order is the entire point.
The practical consequence catches most first-pass classifications out. A use case can read as conversational — a chatbot, say — and still land in High-Risk, because High-Risk is resolved before Limited-Risk is ever evaluated. A resume-screening assistant used in hiring decisions is the textbook case: nothing about it trips a Prohibited check, but it clears the High-Risk test on employment and worker management (Annex III), and the tier is set before the tool's conversational surface is ever considered. Get the sequencing wrong and the classification is wrong, no matter how thorough the underlying analysis was.
A Blank Answer Is Not a Safe Answer
Under a waterfall model, an unanswered question does not default to "unknown." It defaults to NO — and a NO on a High-Risk trigger question means the tier is understated until someone comes back and answers it properly. This is why a defensible classifier treats every blank cell as a standing action item, not a resting state. The discipline is simple: if you are not sure, answer YES and flag it for follow-up. Guessing conservative is cheaper than guessing convenient.
Two Frameworks, One Register — Not Two Disconnected Ones
India's DPDP Act, 2023 runs alongside the EU AI Act, not instead of it. A Minimal-Risk system under the EU AI Act can still carry serious DPDP exposure if it touches personal data of Indian residents — which is why a defensible register asks the DPDP questions for every use case, regardless of EU AI Act tier. Three questions do the work: does the system process personal data of Indian residents in training, inference, or output; does it process children's data (a CRITICAL flag requiring legal review before deployment); and does it make automated decisions with a significant effect on individuals, which triggers a statutory right to human review.
What a Board Actually Needs to See
A classification exercise that lives in a spreadsheet no one else opens is not governance — it is documentation. The output that matters is the one that reaches an audit committee or a board risk committee in a form they can act on in the room.
A risk register that shows a false zero is worse than no register at all. That's not caution. It's theatre.
A workbook that reports £0 exposure before anyone has entered a single Risk Exposure value is not being conservative — it is manufacturing false comfort. A properly built Compliance Exposure Score should refuse to show a number until at least one value has been entered, and should say so plainly: risk quantification not completed. The absence of a figure is information. A fabricated zero is a hazard.
How This Plays Out Inside the Workbook
The AI Regulatory Compliance Risk Register applies exactly this logic across five linked tabs: a read-only Instructions tab; a Use Case Classifier that runs up to 10 AI use cases through the Prohibited → High-Risk → Limited-Risk → Minimal-Risk waterfall alongside the three DPDP questions; a Compliance Gap Register pre-seeded with 30 requirements — 18 EU AI Act High-Risk obligations, 6 EU AI Act general obligations, and 6 India DPDP obligations; a Regulatory Timeline tracking six phase-in milestones; and a Board Summary Dashboard that calculates every figure above automatically from the other four tabs.
- Entirely formula-based — no macros, no VBA, works in Excel 2016 through Microsoft 365.
- Every tab fully editable — no password protection, adapt it to your organisation's structure.
- A full .pdf User Guide included, with a worked classification example and troubleshooting FAQ.
Q: What order does the EU AI Act risk tier waterfall follow?
A: Prohibited is checked first and cannot be bypassed; only if clear does the process check High-Risk; only if High-Risk is clear does it check Limited-Risk; anything remaining defaults to Minimal-Risk.
Q: Why can a chatbot be classified High-Risk under the EU AI Act?
A: Because High-Risk is resolved before Limited-Risk in the waterfall. A conversational system used in a High-Risk context, such as employment decisions, is classified High-Risk regardless of its conversational surface.
Q: Does India's DPDP Act apply even if an AI system is Minimal-Risk under the EU AI Act?
A: Yes. DPDP obligations are assessed independently of EU AI Act tier, based on whether the system processes personal data of Indian residents, children's data, or makes automated decisions with significant effect.
Frequently Asked Questions
Is this workbook a substitute for legal advice?
No. It provides structured, indicative guidance based on publicly available regulatory texts as of the version date and does not constitute legal advice. Organisations should obtain qualified legal counsel for binding compliance determinations.
How many AI use cases and requirements does it support?
Up to 10 use cases in the Classifier and 30 pre-seeded requirements in the Compliance Gap Register, matching the Board Summary Dashboard's fixed formula ranges.
What happens if a use case classifies as Prohibited?
The tier displays in dark red with a direction to escalate immediately to legal counsel. No mitigation is available under Article 5 — the correct response is escalation, not continued use of the workbook to work around the result.
LEGAL DISCLAIMER
This tool provides structured guidance based on publicly available regulatory texts as of the version date (1 July 2026). It does not constitute legal advice. Regulatory interpretation evolves, and organisations subject to the EU AI Act or India DPDP Act should obtain qualified legal counsel for binding compliance determinations. Classifications produced by this tool are indicative only.
GET THE TOOL
AI Regulatory Compliance Risk Register
One Excel workbook. Five tabs. A defensible classification and tracking layer for the EU AI Act and India's DPDP Act — with a full .pdf User Guide included.
▸ Classify up to 10 AI use cases against the full EU AI Act waterfall
▸ 30 pre-seeded compliance requirements, ready to assess on day one
▸ A board-ready dashboard with a risk-weighted exposure score