Part V. Adopting AI in the company with Scrum

Compliance does not have to slow you down

The EU AI Act, data and human oversight inside the Sprint

A report for tomorrow

The day before rolling out the assistant in every gym, the committee asked for "a compliance report". Julián, the data protection officer, had reviewed the pilot months earlier. That afternoon he found out that the version for all the gyms read each member's booking history, something that was not in what he had reviewed. He asked for a week.

Ramón said the launch had already been announced. Julián replied that in that case they could launch it without his signature.

The launch was delayed by ten days. Not because there was a serious problem, but because nobody knew whether there was one.

Compliance at the end slows you down

Compliance that arrives at the end slows you down. It turns into a gate that someone has to open on the last day, with little information and a lot of pressure. Compliance that lives in the backlog and in the Definition of Done does not. It gets done bit by bit, along with the work, and there are no surprises on the last day.

What the EU AI Act means for a team

The European Artificial Intelligence Regulation (the EU AI Act) is long, but what matters to a team implementing a use case comes down to four things:

Classify the risk of the use case. Most uses in a company are limited or minimal risk. Some, such as those involved in hiring, education, granting credit or access to essential services, are high risk and carry much heavier obligations. Knowing which case you are in comes first.
Transparency. Anyone talking to an assistant has to know they are talking to an AI. This is mandatory from August 2026.
AI literacy. The people who operate or oversee AI systems must have enough training. This obligation has applied since February 2025.
Human oversight. A person able to understand what the system does, to spot when it is wrong and to stop it.

Data

The GDPR still applies, with or without AI. The practical question for the team is which personal data goes into the prompts and the agents, where it goes and how long it is kept. The GymTonic assistant read the member's booking history to give better answers. That requires a legal basis, informing the member and a contract with the model provider that states what it does with that data.

A few rules, written down and known

An AI use policy does not have to be a fifty-page document. It has to say which tools can be used, which data must never be used with them, what always has to be reviewed and who to ask. A few rules, written down and known by everyone.

And a register of AI systems: a list of the use cases in operation, with their risk, their data and the person accountable for each one.

Who is accountable

One named person per system, not a committee. The committee can set the policy, but on the day the assistant gets something wrong, someone has to be able to stop it and explain what happened. At GymTonic, Mercedes became the owner of the assistant: she is the one who knows the queries and the one who receives the complaints.

The checklist before production

All of this fits into a checklist that is part of the use case's Definition of Done:

The risk of the use case is classified and documented.
Anyone using the system knows they are talking to an AI.
We know which personal data it uses, on what legal basis and what the provider does with it.
The people who operate it have been trained.
There is a named person who is accountable, who can stop it and knows how.
It is in the register of AI systems.
There is a signal that warns if something goes wrong and a rehearsed rollback.

If you meet these points Sprint by Sprint, you need no report on launch day: showing the checklist is enough.

After the delay, Julián asked to join the team's Product Backlog refinement once a month. The next use case went out without waiting a single day for him.

In short

Compliance at the end slows you down; in the backlog and in the Definition of Done, it does not. Classify the risk, be transparent, train the people who operate the system and guarantee human oversight. A few written rules, a register and one named person per system.

Try it this week

Apply the seven-point checklist to your most advanced use case. Whatever comes out as "no" goes into the backlog.

For the first point you have the EU AI Act checklist (in Spanish), and for the rules, the AI use policy template (in Spanish), ready to adapt.