As soon as several departments want to use AI, the same questions come from every side: who decides what is allowed? Which applications fall under the AI Act? And which ones deliver enough to be worth building? AI governance with a value concept answers all three with a fixed process: one entry point for all ideas, a risk classification under the AI Act, a value calculation for each use case and a portfolio that is actively steered.

Starting point

When several departments want to use AI, ideas come up in many places at once: in IT, in specialist departments, from individuals with their own trial accounts. Without a place that collects them, each department assesses value and risk differently, or not at all. Which idea gets built then depends more on who pushes it than on value and risk.

The AI Act adds binding obligations. For many of them, a company first has to know which AI systems it actually uses. Without a central record, that overview is missing.

Goal

  • One entry point for all AI ideas, with the same questions for every idea.
  • A risk classification under the AI Act before anything is built.
  • A value calculation for each use case, following one consistent method.
  • A portfolio that shows what is running, what is waiting and what is being retired.
  • Clear roles: who submits, who reviews, who decides.

Governance should not act as a brake. A low-risk use case should reach approval faster than without a fixed process.

Architecture

Here, the architecture is not a software system but a process with fixed stations. Tools support it, but they do not carry it. A form and a well-kept list are enough to start with.

Diagram: An idea enters the register through the use-case intake and goes into the risk review under the AI Act, then into the value assessment with a measured baseline. The AI board decides on pilot, scale-up or stop. The measured value from pilot and operation feeds the portfolio, which is reviewed regularly and goes back to the board.

  • Use-case intake: a short form covering the problem, the data involved, the user group, the expected benefit and the person responsible.
  • Use-case register: the central list of all use cases with status, classification and owners. It is also the basis for evidence towards supervisors and internal audit.
  • Risk review: classification under the AI Act, together with data protection and information security in a single pass.
  • Value assessment: benefit and effort following one consistent method, with a measured baseline.
  • AI board: decides on pilot, scale-up or stop. It is a small group in which the business, IT, data protection and information security are represented.
  • Portfolio steering: an overview of all cases by value, effort and risk, reviewed at fixed intervals.
  • Operations and monitoring: running applications are re-assessed regularly, with measured rather than estimated values.

Implementation

The intake form has only a few mandatory fields. A long questionnaire keeps ideas away and drives employees back to private accounts. Details are collected only once an idea passes the first review.

The risk classification runs in two stages. The pre-check consists of yes-or-no questions based on the AI Act:

  • Does the case touch a prohibited practice under Article 5, for example emotion recognition in the workplace?
  • Does it fall under Annex III, for example screening job applications or evaluating employees? Then it is a high-risk case.
  • Does the system interact directly with people or generate content that appears authentic? Then the transparency obligations of Article 50 apply.

If every answer is no, the case counts as minimal risk and takes the fast track. Only cases with a yes go into the full review. That is also where the role becomes clear: anyone who develops an AI system and puts it into service under their own name is a provider under the AI Act, not just a deployer, even for purely internal use. That changes the obligations considerably.

For the value concept, each use case gets a value sheet. It records which lever the case works through: time saved, better quality, more revenue or lower risk. The baseline is measured before launch, and the same value again after the pilot. A simple rule applies: without a baseline, there is no approval for a pilot.

The portfolio arranges all cases by value and effort and colour-codes the risk class. Every case passes through the same stages: idea, review, pilot, operation, retirement. The board reviews the portfolio at fixed intervals and retires cases whose measured value falls short of the estimate.

Infrastructure and EU compliance

The AI Act has been in force since August 2024 and applies in stages. The prohibitions under Article 5 and the AI literacy obligation under Article 4 have applied since February 2025, the rules for general-purpose AI models since August 2025. The transparency obligations under Article 50 have applied since 2 August 2026. The digital omnibus changed the timetable: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026. It moves the obligations for high-risk systems under Annex III to 2 December 2027, and for AI in products under Annex I to 2 August 2028. The register records which obligation applies from when, so that no deadline comes as a surprise.

The governance framework also defines which infrastructure AI applications may run on. For European companies, platforms that process data in the EU are the natural choice, for example Azure OpenAI in EU regions, models from Mistral or European cloud providers. New providers go through the same review as new use cases.

Data protection does not run alongside the process but within the same pass. The GDPR questions sit in the same form as the AI Act questions. Where a data protection impact assessment under Article 35 GDPR is needed, it starts directly from the register. In Austria, the works council should be involved early: many AI applications process employee data and, in companies with a works council, usually need its consent under sections 96 and 96a of the Labour Constitution Act, typically through a works agreement.

Outcome and value calculation

With this process, a company has one entry point for all AI ideas, a register of all use cases and a board that decides by the same criteria. Low-risk cases reach approval faster. High-risk cases are spotted early, before money flows into development.

The value concept uses the same formula for every use case:

  • Time value = cases per month × minutes saved per case × internal hourly rate.
  • Quality value = errors avoided per month × cost per error.
  • Value per use case = time value + quality value + revenue effect − (development + operation + governance effort).
  • Priority = value per use case divided by effort, with a deduction per risk class.
  • Portfolio value = sum of the measured values of all running use cases.

The most important part of the method is the comparison: estimated value at intake against measured value after the pilot. Anyone who regularly estimates too optimistically sees it there in black and white. Over time, the estimates improve, and the portfolio shows the value AI delivers in the company.

You can find more projects in the overview of reference projects.