--- title: "AI Act Register and Assessments | Pitch" description: "One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an…" url: https://www.pitch.law/technologies/ai-act-governance-toolkit --- [pitch](https://www.pitch.law/) [Technology](https://www.pitch.law/technologies) [Privacy, data & AI](https://www.pitch.law/technology-categories/privacy-data-ai) # AI Act Register and Assessments One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney. ## What it does AI Act compliance starts with a simple question: which AI systems do you have, and what does the Act ask for each one? This register keeps the answer in one place instead of scattered spreadsheets and emails. It runs on the same register engine as our records of processing and other compliance registers, so you can link an AI system to the personal data it uses. It supports our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) service. The register organises and explains; an attorney reviews every classification and every conclusion before it counts. ## Functions ### Inventory and classification of AI systems Each AI system goes in with its purpose, supplier, users, data and owner. The register guides you through the classification: prohibited practice, high-risk (including the carve-out for certain Annex III systems, which needs a documented assessment), system with transparency duties, or something else. Every conclusion shows the articles it rests on, so you can check the reasoning. See [risk classification explained](https://www.pitch.law/academy/ai-act-risk-classification-explained). **Input:** a short description of the system, its supplier and what it is meant to do, from you or from us in an intake session. **Output:** a classification with the articles behind it. **Check:** the attorney reviews the reasoning, especially any exemption claimed for an Annex III system, which has to be documented. ### Obligations per role The same system comes with different duties depending on whether you are the provider or the deployer, and your role can change. The register records your role and lists the duties that follow: use, oversight and information for a deployer; documentation and conformity for a provider. See [provider or deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). **Input:** the role and the classification. **Output:** a list of duties for that role. **Check:** the attorney confirms the role is right, because a new name, a new purpose or a substantial modification can change it. ### Conformity assessment tracking For high-risk systems you provide, the register follows the steps to conformity: technical documentation, quality management, the assessment route, the declaration of conformity and registration. Each step has a status and its evidence attached. See [conformity assessments for high-risk AI](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems). **Input:** documents and evidence uploaded by you or your supplier. **Output:** a status per step and a view of what is still missing. **Check:** the attorney reviews the evidence before a step is marked complete. ### General-purpose AI models Models that can do many things are recorded separately, with the information that matters for the provider obligations that have applied since August 2025 and for the providers and deployers who build on them. ### Fundamental rights impact assessment When a system is high-risk, the register starts the Article 27 assessment where it applies to you. You and your attorney finish it together in the client portal, and it can build on an existing data protection impact assessment. **Input:** the classification of the system. **Output:** a draft assessment pre-filled with the system details. **Check:** you and the attorney complete and approve it. ### AI Act timeline A timeline shows which obligations apply to your systems and from when, including the postponements adopted in 2026. See [what applies when](https://www.pitch.law/academy/ai-act-compliance-timeline). ### Incident records Serious incidents and malfunctions are logged with date, description, assessment and follow-up, so you and your attorney can decide whether to report to the authority. ### A matter from start to finish A Leuven software company adds an automatic CV ranking feature to its HR product. We enter it in the register. The classification shows an employment use in Annex III involving profiling, so the feature is high-risk and the company is the provider. The register lists the provider duties and the dates, and opens the fundamental rights assessment. The company uploads its documentation step by step. Six months later a customer reports an odd ranking result; it is logged as an incident and assessed with the attorney. At every point the attorney decides, and the register keeps the trail. ## What you receive You get the register as a living document: inventory, classifications with their legal basis, duties per system, assessment records and evidence. Export it as a report for a customer, auditor or board. In the client portal you see the AI Act view, edit entries and upload evidence, and the attorney reviews and approves. ## Where it is used We use it in every [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) engagement, from a first inventory to keeping up with new tools. Its data protection counterparts are the [records of processing and compliance registers](https://www.pitch.law/technologies/privacy-register) and the [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment). Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU. ## In short - One inventory of all AI systems and general-purpose AI models - Classification and obligations per system and per role - Conformity assessment tracking for high-risk systems - Fundamental rights impact assessment started automatically - Incident records and an AI Act timeline - Shared with you in the client portal ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Background reading - [Academy](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) ### [The EU AI Act: a Practical Overview](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) [What the AI Act regulates, who it applies to, how the risk-based approach works and what the penalties are, as of October 2026.](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) - [Academy](https://www.pitch.law/academy/ai-act-risk-classification-explained) ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - [Academy](https://www.pitch.law/academy/provider-vs-deployer-ai-act) ### [Provider or Deployer?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) [The AI Act allocates duties by role. Who counts as provider, deployer, importer or distributor, and when does a deployer become a provider?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) - [Academy](https://www.pitch.law/academy/ai-act-compliance-timeline) ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - [Academy](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) ### [Conformity Assessments for High-Risk AI](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) [What a provider of a high-risk AI system must demonstrate before market entry under the AI Act, which assessment route applies and what follows afterwards.](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) - [Academy](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - [Academy](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - [Academy](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) - [Academy](https://www.pitch.law/academy/building-an-ai-governance-framework) ### [Building an AI Governance Framework](https://www.pitch.law/academy/building-an-ai-governance-framework) [What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use of AI.](https://www.pitch.law/academy/building-an-ai-governance-framework) ## More in Privacy, data & AI - ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)