A 30, 60, and 90 day plan you can start now.

Find out where you stand and stop anything that cannot wait.

• Inventory where AI is used across the organization: which tools, which teams, for what.
• Identify your role for each use: provider or deployer.
• Run the prohibited-practices screen and escalate anything that looks banned.
• Flag which uses touch high-risk areas: hiring, credit, insurance, biometrics.
• Publish an interim guide for public AI tools: what may and may not be pasted.
• Start AI literacy with a short briefing for staff who use AI.

Put the concrete controls in place, starting with anything due this August.

• Set up the transparency disclosures for 2 August 2026: chatbot notices and AI-content labels.
• Assign human oversight for each high-risk use, with named, trained owners.
• Run a data protection impact assessment where personal data is involved, and a fundamental rights impact assessment where required.
• Collect provider documentation and instructions for the high-risk systems you deploy.
• Define log retention (at least six months) and the 15-day serious-incident reporting process.

Turn the controls into a routine, and cover the everyday human layer.

• Formalize AI governance: an owner, a register of AI uses, and a review cadence.
• Roll out training and the knowledge check to the teams that use AI.
• Add in-the-moment guidance on the human-use layer: what people write, and what they paste into AI.
• Set a monitoring routine and a re-review date tied to the Omnibus publication.
• Brief leadership on residual risk and the December 2027 high-risk horizon.