A RACI Model for EU AI Act Compliance

The EU AI Act tells you what must be done; it does not tell you who in your company does it. That gap is where compliance quietly fails — a duty everyone assumes someone else owns. A RACI model closes the gap by assigning, for each obligation, who is Responsible (does the work), Accountable (owns the outcome, one person), Consulted (gives input), and Informed (kept in the loop). Be clear up front: RACI is a management practice, not a statutory term. Regulation (EU) 2024/1689 never mentions it. But it is the cleanest way to turn the Act's duties into named ownership — and that traceability is exactly what an auditor wants to see.

This page maps the core duties to functions and walks a worked SME RACI you can adapt.

---

Why a RACI, specifically

The Act spreads duties across the organisation: technical work, legal interpretation, security, data, product decisions, and a single accountable owner per system. Without a deliberate map, three failure modes recur:

• Two-people-or-nobody. A duty has either no clear owner or several, so it slips.
• Accountability with no authority. Someone is "accountable" but cannot actually direct the work.
• The DPO catch-all. Everything AI-shaped lands on the data-protection officer, who lacks the engineering context to discharge it.

A RACI forces the choice. The discipline is simple but unbendable: exactly one Accountable per duty. Responsible can be shared; Accountable cannot.

---

The duties to map (and the right Article on each)

Map the obligations that actually generate work. Cite the right Article on each — this is the spine of the model:

Two notes on accuracy. Article 10 is data governance, not staff training — staff competence is Article 4 (AI literacy), a separate, already-in-force duty worth adding to the map. And Article 73 is the provider's serious-incident report; post-market monitoring by the provider is Article 72 — keep the two distinct.

---

The functions to map them to

Down the other axis sit the functions that carry the work:

• Named accountable owner (per use case) — usually a product or business lead; the single Accountable for that system end to end.
• Compliance / risk — runs the assessment, owns the register, tracks status.
• Legal / DPO — classification calls, FRIA where it applies, GDPR interface; Consulted, rarely Responsible for engineering tasks.
• IT / security — cybersecurity controls (the Article 15 limb), logging, access.
• Data — data governance under Article 10, dataset documentation.
• Product / engineering — builds the oversight mechanisms, the technical file inputs, the fixes.

The DPO is Consulted on most AI duties and Accountable only for the GDPR-overlap pieces — not the default owner of everything.

---

Tie it to the use-case register

A RACI is only as good as the list of systems it covers. Anchor it to your AI use-case register — the inventory of every AI system you build or deploy — so each entry carries its own RACI row: classification, accountable owner, and the status of each mapped duty. The register is where the RACI lives; without it, the model is an abstract grid with nothing to attach to. (See the AI use-case register.)

---

Worked example: an SME's RACI

Brightform GmbH — a fictional 90-person German HR-software company (~€16M turnover) — deploys a third-party CV-screening tool (high-risk, Annex III point 4) and provides its own AI feature that drafts job descriptions (limited-risk). It builds one RACI per system, anchored to its use-case register.

For the high-risk CV-screening deployment:

The named accountable owner is the Head of People Ops — the person who actually owns the hiring outcome — not the DPO, who is Consulted. Because Brightform deploys this tool rather than building it, the Article 11 technical file sits with the vendor (the provider); Brightform's job is to confirm the vendor supplies it and that the deployer duties under Article 26 are met. For its own job-description feature, a lighter RACI covers the Article 50 transparency notice. As an SME, Brightform's penalty exposure is capped at the lower figure under Article 99(6).

The verdict: two systems, two RACIs, one accountable owner each — and an auditor can trace every duty to a named person. That is the whole point of the exercise.

---

A caveat on the deadline

The high-risk duties this RACI maps apply from 2 December 2027 for stand-alone Annex III systems under the Digital Omnibus agreed in May 2026. That deferral is now formally adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026 — pending only Official Journal publication, expected before 2 August 2026. Article 4 AI literacy and the Article 5 prohibitions are already in force, so the governance work — including assigning ownership — should not wait for 2027.

---

How Confir helps

Confir builds the use-case register the RACI hangs on: every AI system registered, classified under Articles 5 and 6, and assigned its role — Provider (Art 16), Deployer (Art 26), Importer (Art 23) or Distributor (Art 24). Each entry carries the obligations that apply and a named owner, so the RACI is grounded in real systems rather than a blank grid. The classification and role logic is deterministic and rule-based, with each finding cited to its Article. Confir does not assign your people for you — that judgment stays with you — but it gives you the structured list of duties-per-system to assign against.

Related guides

• AI use-case register
• AI governance committee
• Deployer obligations (Article 26)
• Article 9 — risk management system
• Article 14 — human oversight
• Serious-incident reporting (Article 73)