The AISDP preparation follows a seven-phase delivery workflow spanning approximately 20 to 28 weeks for a medium-complexity high-risk system. Phases overlap; risk assessment informs architecture, which informs development, and development may begin before risk assessment is fully complete.

Phase 1: Discovery and Classification (Weeks 1–3). Determine scope, classify risk tier, produce the Classification Decision Record. Phase 2: Risk Assessment and FRIA (Weeks 2–6). Conduct the five-method risk identification, establish the risk register, perform the Fundamental Rights Impact Assessment. Phase 3: Architecture and Design (Weeks 4–8). Design the system architecture informed by the risk assessment, select the model approach, establish data governance and version control frameworks.

Phase 4: Development and Testing (Weeks 6–18). Build the system with compliance evidence generated as a byproduct of the engineering workflow. Phase 5: Pre-Deployment Validation (Weeks 16–20). Validate the complete system, compile the AISDP, conduct internal conformity assessment. Phase 6: Registration and Deployment (Weeks 20–22). Register in the EU database, affix CE marking, deploy to production. Phase 7:Operational Monitoring (Ongoing). Maintain the system’s compliance posture through continuous monitoring, periodic review, and responsive action.

Each phase produces defined artefacts and concludes with a governance gate that must be passed before proceeding. The timeline assumes that foundational infrastructure (version control, CI/CD, monitoring) is in place before the system-specific workflow commences. Factors that increase effort include third-party GPAI models with limited disclosures (add 3 to 6 weeks), brownfield systems (add 4 to 10 weeks), biometric identification requiring third-party assessment (add 6 to 12 weeks), and organisations without existing compliance infrastructure (add 8 to 16 weeks). Fully loaded costs for a medium-complexity system range from EUR 150,000 to EUR 400,000 for initial preparation, with annual ongoing costs of EUR 50,000 to EUR 150,000.

Key outputs

• Phase-gated delivery plan
• Resource and timeline estimate