When and how to update AI compliance documents

AI compliance documents must be updated whenever what they describe changes - when a company starts using a new AI tool, employees or responsible persons change, new EU AI Act (Regulation (EU) 2024/1689) obligations arise, or the annual review period passes. AI compliance documentation is not a one-time task to be filed away: documents reflect the living reality of a company’s AI usage, which constantly evolves. For a micro-enterprise, a clear review process is sufficient to prevent documents from becoming outdated after the first new tool or team change.

Why can’t AI compliance documents be prepared once and forgotten?

Article 4 of the EU AI Act (Regulation (EU) 2024/1689), effective from 2 February 2025, requires organisations to take measures to support the development of AI literacy among staff and relevant persons, considering their knowledge, experience, training, the context of use, and the people affected. This obligation does not require guaranteeing a specific or sufficient individual level of literacy.

In practice, this means that if your team used only one chatbot six months ago but now works with three different AI tools, outdated documents no longer reflect reality. Presenting an obsolete AI tool registry or policy to a supervisory authority or a client requesting proof of compliance can be worse than having no documents at all - it shows that the process exists only on paper.

AI compliance maintenance is a cycle: prepare → use → monitor changes → update. Without the final step, the entire system collapses within a few months.

What events trigger AI document updates?

There are two types of updates: calendar-based (scheduled reviews) and event-based (immediate reaction to changes). For micro-enterprises, event-based triggers are the most critical - and the most frequently overlooked.

The most common trigger in a small company is a new tool. An employee discovers a new AI assistant over the weekend, starts using it for work, and no one records it. This is why a continuously updated AI tool registry is the foundation of a compliance system - without it, you have no reference point.

How often should scheduled reviews be conducted?

For a micro-enterprise (1 - 30 employees), one possible internal review schedule is:

• Annual full review - once a year, review all four core documents (policy, registry, compliance log, employee guide) and verify that everything matches reality.
• Quarterly quick check - every 3 months, spend 15 minutes asking the team: “Have we started using any new AI tools? Has anything changed?” This is the cheapest way to catch unrecorded events.
• Trigger-based response - whenever any of the events listed in the table above occur.

Important: scheduled reviews do not replace event-based updates. If you wait for the annual review to record a tool that was adopted six months ago, the record may no longer accurately describe the tools used during that period.

What exactly to update in each document?

The four core documents are updated at different frequencies because they cover different aspects.

AI tool registry. This is the most dynamic document - you’ll edit it most often. Add new tools, mark inactive ones, and update their purpose, risk category, and whether they process personal data. For more details on how to create one, see the article on the AI tool registry.

AI usage policy. This is updated less frequently - when rules change (e.g., you prohibit the use of unapproved public tools for processing personal data without assessing legal basis, data minimisation, and safeguards), responsible persons change, or the company’s approach to AI evolves. How to structure the policy is described in the article AI usage policy in a company.

Compliance log. This is a chronological journal - you never “rewrite” it, only add new entries: when a review was conducted, when a tool was added, when employees were trained. This document later proves that compliance was maintained consistently, not fabricated at the last minute.

Employee AI guide and training. These are updated when tools or rules change and whenever a new person joins. New hires must be introduced to the guide and, if necessary, complete AI literacy training with a knowledge check. Training and guides are not mandatory legal requirements but a practical way to demonstrate that measures to support AI literacy development have been taken.

How to turn updates into a stable process, not chaos?

Tips that work specifically for small teams where no one has time for “compliance administration”:

1. One responsible person. Assign one person (often the manager) to oversee document reviews. Without clear responsibility, updates never happen.
2. Integrate AI questions into existing routines. For example, add a question about new AI tools to your quarterly financial review. A new separate process will be forgotten; an existing one won’t.
3. Record immediately. When a colleague asks, “Can I use this tool?” - that’s the best moment to update the registry. Delay means forgetting.
4. Keep documents editable. If you only have a PDF that can’t be modified, updates become painful. Ideally, documents should be version-controlled so new versions can be prepared quickly when needed.
5. Mark dates. Every update must have a date. This is the essence of the compliance log.

Before deploying a new tool, it’s useful to have a clear process for who evaluates and who approves it. The AI deployment checklist helps with this - review it every time the team wants to start using something new.

How to align updates with EU AI Act deadlines?

The Regulation’s obligations take effect in stages, so document reviews should be planned around these dates:

• 2 February 2025 - AI literacy obligation (Article 4) and prohibited AI practices rules took effect.
• 2 August 2026 - most remaining provisions of the Regulation, including supervision and enforcement, took effect.
• 2 December 2027 - high-risk AI systems (Annex III) rules take effect.
• 2 August 2028 - high-risk AI embedded in regulated Annex I products rules take effect.

Each of these dates is a natural signal to review documents and check for gaps. The full timeline is detailed in the article EU AI Act deadlines.

Note: The AI literacy requirement applies to all companies, regardless of size, proportionate to the context of use. Therefore, updates to training and guides cannot be postponed.

Does a micro-enterprise need a lawyer for updates?

No. AI document maintenance in a small company is a structured, repetitive task - updating the registry, recording dates, repeating training for new hires. This can be done independently if you have the right templates and a clear process. The EU AI Act does not mandate specific certificates, a fixed document bundle, set training hours, external auditors, or a dedicated AI officer. The main mistake is treating documents as such a serious legal project that updates never happen.

If you want to prepare an initial set of documents without effort, nebedirbam.lt automatically generates a full AI compliance documentation package (AI usage policy, AI tool registry, compliance log, and employee AI guide) plus AI literacy training with knowledge checks and certificates for a fixed €149 + VAT (€299). Documents are created based on your answers in a questionnaire and are version-controlled, making future updates straightforward. These documents are practical aids but do not guarantee legal compliance. If you only want to start with AI literacy for now, there are also free AI literacy training modules. The free path is for one signed-in participant; team training is included in the paid documentation package.

Quick update checklist

• Update immediately when an AI tool is added or removed, the responsible person changes, or rules are modified.
• Consider an annual full review and a quarterly quick check, adapted to changes in your company.
• Never delete the compliance log - only add to it with dates.
• Introduce new employees to the guide and, if necessary, train them during onboarding.
• Align reviews with EU AI Act dates (2 February 2025, 2 August 2026, 2 December 2027, 2 August 2028).

For more practical articles on EU AI Act compliance, documents, and AI literacy, see the full list of articles. Regular but simple AI compliance maintenance is far cheaper than a last-minute scramble when documents are suddenly requested by a client or authority.

This article’s legal references are based on the official requirements of Article 4 of the EU AI Act (Regulation (EU) 2024/1689), as provided on AI Act Service Desk and the European Commission’s Digital Strategy page.