Phases and gates: why the next step is locked

Every programme runs in phases. In a standard's programme a phase is locked until every counted step in the phases before it is done; the GDPR programme is the exception (below). This is the rule the EU AI Act journey already applies to each system's six stages (Classify · Scope & literacy · Build & document · Conformity assessment · Register · Operate & monitor); the programmes borrow it verbatim.

The phases, by programme

The two ISO programmes share the Annex SL spine every ISO management-system standard is built on, which is why their phases match. NIST AI RMF 1.0 is its four functions and ends in a profile document, not a readiness gate.

Why gates

Because the standards are built that way. You cannot treat risks you have not assessed; you cannot audit a management system whose scope is not written; a management review with nothing to review is a meeting, not a record. The gate stops the programme producing records in an order an auditor would reject.

Reading the programme page

The phase strip under the header shows each phase and the gate. On the Steps tab every phase is a panel headed n of m done, with a pill — complete, in progress, or locked — finish the phase before. A locked step still opens, read-only, so you can see what it will ask. A few steps are marked never locked: they can be worked at any time.

A step counts as done when its status is Done — approved by a person, or credited by work already on file (it then reads Done · credited). A step marked Not applicable is outside every count. The programme card on Programmes names the next step: the first open step in the first unfinished phase, in plan order.

Empty phases

A phase with no applicable steps counts as complete, so a programme never stalls on work it does not have.

GDPR: grouped, never gated

The GDPR programme is the one programme without gates. Its steps — your GDPR organisation duties — are grouped in the order data-protection work happens — Establish · Map · Protect · Operate — plus Conditional / specialist, and are also listed on Obligations with the group as their Stage (GDPR · Establish, and so on). Nothing in one group waits for another, and no GDPR duty counts toward an EU AI Act gate or the journey figure.

The Conditional / specialist group holds consent, the EU representative, international transfers, supervisory-authority cooperation, codes of conduct and certification. Three of its duties apply only when something is true of you:

• Consent — when processing relies on consent, including children's online services.
• International transfers — when personal data leaves the EU/EEA.
• Codes and certification — when you join an approved code of conduct or certification scheme.

They start Not applicable. The transfers duty switches itself on when a system on your register is flagged for cross-border transfer; the other two have no register fact behind them, so you switch them on by setting the status to To do. A duty you do not need stays Not applicable and is outside every count. The plan never overrides a status a person set, in either direction.