Scope obligations and assign owners

Once a system is classified, the engine derives its obligation set and the journey moves into the Scope & literacy stage (the second of six). Scoping is a short but important pass: you confirm which derived obligations genuinely apply, put a named owner on each, and settle your Art. 4 AI-literacy duty before the heavy implementation work begins.

Where the applicable obligations show up

The obligations the engine generated appear in two places, both live views of the same records:

• On the system — the Obligations tab of the system record lists every one, lane by stage. A locked stage says what it waits on.
• Across the portfolio — Obligations (under Position) is the one register for every obligation on every system, plus the organisation's own duties — the Art. 4 literacy duty, once, and the GDPR organisation duties. Filter it by source, scope, stage, status, system or domain.

Open any obligation to see its record — the article reference, what it requires, its checklist — and the way into its guided assessment, where the work is done.

Confirm what applies

1. Open the system's Obligations tab and read down the list — this is the full set the engine derived from your classification, flags and GDPR answers.
2. Open each obligation. Read the article reference and description to confirm it fits how you actually use the system.
3. If an obligation genuinely does not apply, set its status to Not applicable in its guided assessment. This is a scoping call, not a completion claim — the completion figures simply exclude it, and no approval gate applies. Leave a note so the de-scoping decision is auditable.
4. Leave everything that does apply at To do for now — the Build & document stage is where it is worked.

Do not mark obligations Done during scoping to "clear" the stage. The gate wants genuine completion. De-scope only what truly does not apply.

Assign owners

Accountability is per obligation. On the obligation's record, Edit owner & target picks a team member as Owner (choose Unassigned to clear it) and sets an optional Internal target date, which puts the item on the Timeline and in the Dashboard's Needs attention queue as it approaches. You can also set an Owner for the whole system, and start many obligations at once from the register's bulk bar.

Owners receive the reminders the platform sends, so an unassigned obligation is one nobody is watching. The Dashboard treats it as a gate: while any duty is unowned, its Needs your attention panel puts assign owners first and shows the items beneath it as locked, with no dates — because a date on a duty nobody owns is fiction.

Art. 4 AI literacy sits in this stage

The Scope & literacy stage also carries your Art. 4 duty, in force since 2 February 2025, to take measures that support the AI literacy of the people who deal with your AI systems. It is an organisation obligation — you satisfy it once for the workspace, not once per system — and the record behind it is built in the Academy. See The Academy: your AI literacy record, and when it lapses.

Gate-locking

A stage is complete when every applicable EU AI Act obligation in it is done, or when it has none (then it is complete by definition). A later stage is locked while any earlier, non-empty stage is below 100%. GDPR duties sit in the stage they belong to but never count toward its gate. The stage strip on the system record shows it — complete stages filled, the current stage highlighted, a locked stage greyed with a note naming what is blocking it. See The EU AI Act journey: six gated stages per system.