AI Act Register and Assessments

What it does

AI Act compliance starts with a simple question: which AI systems do you have, and what does the Act ask for each one? This register keeps the answer in one place instead of scattered spreadsheets and emails. It runs on the same register engine as our records of processing and other compliance registers, so you can link an AI system to the personal data it uses.

It supports our AI Act compliance service. The register organises and explains; an attorney reviews every classification and every conclusion before it counts.

Functions

Inventory and classification of AI systems

Each AI system goes in with its purpose, supplier, users, data and owner. The register guides you through the classification: prohibited practice, high-risk (including the carve-out for certain Annex III systems, which needs a documented assessment), system with transparency duties, or something else. Every conclusion shows the articles it rests on, so you can check the reasoning. See risk classification explained.

Input: a short description of the system, its supplier and what it is meant to do, from you or from us in an intake session. Output: a classification with the articles behind it. Check: the attorney reviews the reasoning, especially any exemption claimed for an Annex III system, which has to be documented.

Obligations per role

The same system comes with different duties depending on whether you are the provider or the deployer, and your role can change. The register records your role and lists the duties that follow: use, oversight and information for a deployer; documentation and conformity for a provider. See provider or deployer.

Input: the role and the classification. Output: a list of duties for that role. Check: the attorney confirms the role is right, because a new name, a new purpose or a substantial modification can change it.

Conformity assessment tracking

For high-risk systems you provide, the register follows the steps to conformity: technical documentation, quality management, the assessment route, the declaration of conformity and registration. Each step has a status and its evidence attached. See conformity assessments for high-risk AI.

Input: documents and evidence uploaded by you or your supplier. Output: a status per step and a view of what is still missing. Check: the attorney reviews the evidence before a step is marked complete.

General-purpose AI models

Models that can do many things are recorded separately, with the information that matters for the provider obligations that have applied since August 2025 and for the providers and deployers who build on them.

Fundamental rights impact assessment

When a system is high-risk, the register starts the Article 27 assessment where it applies to you. You and your attorney finish it together in the client portal, and it can build on an existing data protection impact assessment.

Input: the classification of the system. Output: a draft assessment pre-filled with the system details. Check: you and the attorney complete and approve it.

AI Act timeline

A timeline shows which obligations apply to your systems and from when, including the postponements adopted in 2026. See what applies when.

Incident records

Serious incidents and malfunctions are logged with date, description, assessment and follow-up, so you and your attorney can decide whether to report to the authority.

A matter from start to finish

A Leuven software company adds an automatic CV ranking feature to its HR product. We enter it in the register. The classification shows an employment use in Annex III involving profiling, so the feature is high-risk and the company is the provider. The register lists the provider duties and the dates, and opens the fundamental rights assessment. The company uploads its documentation step by step. Six months later a customer reports an odd ranking result; it is logged as an incident and assessed with the attorney. At every point the attorney decides, and the register keeps the trail.

What you receive

You get the register as a living document: inventory, classifications with their legal basis, duties per system, assessment records and evidence. Export it as a report for a customer, auditor or board. In the client portal you see the AI Act view, edit entries and upload evidence, and the attorney reviews and approves.

Where it is used

We use it in every AI Act compliance engagement, from a first inventory to keeping up with new tools. Its data protection counterparts are the records of processing and compliance registers and the DPIA. Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU.