The AI systems you use, and what the EU AI Act asks of you for each one
A register of the AI systems your organisation uses, a guided way to work out which rules each one falls under, the duties that follow for your role, and a place to keep the records the Act asks for. For organisations in Ireland, the UK and the EU that use AI — sold on its own, as an add-on, or through your IT or compliance practice.
Do you use AI, and does the Act reach you? Three questions, with the articles behind the answer. Nothing you enter is stored.
What the workspace does
A register of your AI systems
One entry per system: what it is for, who supplies it, your role for it, where it is used, whether it is built on a general-purpose AI model, the business owner and the person who oversees it.
A guided path through the rules, for each system
Prohibited practices, products under EU product-safety law, the Annex III areas, the Article 6(3) derogation and the transparency duties, one step at a time, each with its article. "Not sure" keeps a step open instead of guessing.
Your determination, recorded
The path shows what your answers point to. The classification is yours: you record it, with your reasoning, your name and the date, and earlier ones are kept.
The duties for your role
What a deployer of each system has to do — oversight, logs, informing workers and the people affected, a fundamental rights impact assessment where one is needed — with the citation and the date each one starts.
The records the Act asks for
AI literacy training (who, on what, when), how long you keep a system's logs, a fundamental rights impact assessment structured to Article 27(1), and a note of each notification you send.
Serious-incident clocks
Link an incident in your incident register to an AI system and it runs the Article 73 limits — 15 days, 10 days in the event of a death, 2 days for a widespread infringement or critical infrastructure — beside every other clock that incident owes.
Exports
The register as CSV, a dossier for each system, and a summary for your organisation that counts which duties have a record behind them and which determinations are still open.
What it is not
- It does not classify your AI systems for you. It shows what your answers indicate and the text behind it; the decision is yours.
- It does not file, register or notify anything with any authority, provider or person. It keeps your note of what you sent.
- It does not certify anything or carry out a conformity assessment.
- It supports deployers. It lists a provider's duties with their citations, and does not do the provider workload: technical documentation (Annex IV), a quality management system (Article 17) or conformity assessment (Article 43).
- It does not give legal advice.
- It gives no score. It counts the duties that have a record behind them.
Who it is for
Data protection officers
The Act sits beside the GDPR: a deployer uses the provider's information in its data protection impact assessment, and a fundamental rights impact assessment can cross-refer to that DPIA rather than repeat it.
Legal and compliance
Each duty carries its article and the page of the Official Journal it was read on, the start dates as the Digital Omnibus on AI amended them, and the points where the text still waits on guidance.
HR and people teams
AI used in recruitment, promotion, task allocation or performance monitoring is in Annex III point 4. Before using a high-risk system at work, an employer informs the workers and their representatives.
Heads of AI and data
A single list of the systems in use, who owns each, who oversees it, whether it is built on a general-purpose model, and when it was last reviewed — kept by system, because that is how the Act assigns its duties.
By sector
- Banks and credit unions. Creditworthiness assessment and credit scoring of people is Annex III point 5(b). Every deployer of such a system carries out a fundamental rights impact assessment, whatever kind of body it is.
- Insurers. Risk assessment and pricing for people in life and health insurance is Annex III point 5(c), with the same assessment duty.
- Employers using AI in hiring. Filtering applications or evaluating candidates is Annex III point 4(a); decisions on promotion, termination and performance are point 4(b).
- Education and training. Admissions, evaluating learning outcomes, deciding the level of education and proctoring are Annex III point 3.
- Health. Evaluating eligibility for public healthcare is Annex III point 5(a) and emergency triage point 5(d); AI in a medical device falls under the product-safety route (Article 6(1), Annex I).
When it applies
Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744.
- 2 February 2025Prohibited practices and AI literacy apply.
- 2 August 2026The Act generally applies, including the transparency duties.
- 2 December 2026Two further prohibitions, added by the Digital Omnibus, apply.
- 2 December 2027The high-risk rules apply to Annex III systems — including the deployer duties.
- 2 August 2028The high-risk rules apply to AI in products under EU product-safety law.
The fines the Act sets out
The maximums, from Article 99. For an undertaking, the higher of the two figures; for an SME or start-up, the lower.
Prohibited practices: up to €35,000,000 or 7% of worldwide annual turnover
Non-compliance with the prohibition of the AI practices referred to in Article 5. Regulation (EU) 2024/1689, Art. 99(3).
Operator obligations: up to €15,000,000 or 3% of worldwide annual turnover
Obligations of providers (Art. 16), authorised representatives (Art. 22), importers (Art. 23), distributors (Art. 24) and deployers (Art. 26), value-chain obligations under Art. 25(2) and (4) (inserted by the Omnibus), notified bodies (Arts. 31, 33(1), (3)-(4), 34), and the transparency obligations in Art. 50. Regulation (EU) 2024/1689, Art. 99(4).
Incorrect or misleading information: up to €7,500,000 or 1% of worldwide annual turnover
Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request. Regulation (EU) 2024/1689, Art. 99(5).
For IT and compliance practices
Keep an AI register for each client in the same console as their cyber work. A client that pays for itself adds the AI Act to its own plan, and your practice earns its usual commission on it. For a client your practice pays for, the AI Act can be added per client on your monthly invoice.
- Each client's AI systems count against that client's own plan, not yours.
- The console shows, for each client, whether the AI Act covers it, the band and how many systems are recorded.
- The client's own staff can be given read-only access to their register.
Pricing
Start with the free snapshot, or take any pack with a 14-day free trial. The same price on its own or added to a Compliance Workspace or Team plan, monthly or yearly. See every pack.
5 AI systems
€35/month
or €348/yr billed annually (~17% off)
10 AI systems
€69/month
or €684/yr billed annually (~17% off)
25 AI systems
€159/month
or €1,584/yr billed annually (~17% off)
50 AI systems
€289/month
or €2,880/yr billed annually (~17% off)
No limit
€449/month
or €4,476/yr billed annually (~17% off)
14-day free trial, once per account. Cancel before it ends and you are not charged.
Start with the free snapshot