1. Inventory your AI
A current list of every AI tool in use across browser, desktop, CLI, and MCP, sorted sanctioned, unknown, or high-risk. Not a survey. The First Sweep returns it within 24 hours.
2. Attribute the usage
Tie each tool to a person, a model, and a time. This is the record of use that Article 4 literacy and Article 26 oversight both lean on.
3. Set your policies
Decide what is allowed, and for whom. Write it in plain language, simulate it, then enforce. "Block PII everywhere except HR" is one rule, not a project.
4. Keep signed evidence
Every event on one immutable, signed log. The Manifest exports it mapped to the obligations, gathered daily rather than reconstructed the week before.