Where: the classification intake, and the estate register

Before testing any obligation, establish for each system in your sample:

• the organisation's role (provider, deployer, importer, distributor),
• the system's risk class, and the basis recorded for it,
• whether the classification was derived by the product or determined by a human.

What would be a finding

A classification presented as an organisational determination when nothing records a human confirming it; a high-risk classification with no recorded basis; or a role assigned per-tenant rather than per-system, which the Act does not support.

An honest state you will meet

In the demonstration tenant the estate was seeded by fixture rather than driven through the intake, so the journey's classification step reads not started. The intake works; this tenant did not use it. Ask to see one system driven through it live if you want to test the mechanism.