EU AI Act compliance software from AI inventory to obligations
List every AI system your teams use, classify its risk, confirm whether you are the provider or the deployer, and turn the obligations into tasks and documents.
AI Register
EU AI Act: inventory of AI systems used across the organisation
| Systems | Vendor | Role | Risk level | DPIA status | Progress | Classified date |
|---|
Every AI system, with its obligations attached
Open a system to see its role, risk level and what still needs doing: the actions to take in the real world, and the documents to keep as evidence.
Greenhouse AI recruiting
✦ AI▲ High-riskSummary
System detailsClassification
Actions
Real-world steps to complete outside the register. Create a task for each to track progress.
Documentation
Everything at a glance
Role, vendor, purpose, personal data and DPIA status, with outstanding actions and missing documents.
Obligations with references
Each obligation comes with its AI Act article. Create a task to assign it and track progress.
Evidence checklist
Required and recommended documents for your role and risk level, ready before anyone asks.
Linked to processing
Personal data is inferred from linked processing activities, and DPIAs start from the record.
Answer simple questions. Get a clear risk result.
Guided questions place each AI system in the AI Act’s risk levels and show the obligations that follow. Try it with the questions on the right.
- Four questions, one resultDecisions about people, sensitive data, high-risk sectors and prohibited techniques decide where each system lands.
- Provider or deployerConfirm your role per system, because the obligations differ for the organisation that builds it and the one that uses it.
- Reclassify when things changeA new use case or feature can change the result. Reclassify and the obligations update.
No specific AI Act obligations beyond AI literacy. Keep it in the register.
The result shown here is a simplified illustration. In the platform, the classification also takes your role as provider or deployer into account.
Built for privacy, legal, compliance and product teams
Give every team involved in AI governance one shared place to classify systems, document decisions and see what needs action.
Connected to GDPR
Link AI classification with DPIAs, RoPAs, vendor reviews and accountability documentation.
One consistent process
Identify AI Act roles, classify risk and document obligations the same way every time.
Review before launch
See when an AI feature needs review before release and which safeguards must be in place.
A clear overview
See AI risk exposure, high-risk systems and unresolved actions across the organisation.
One inventory of AI tools across teams, vendors and group companies.
Guided questions give each system a clear risk level.
Provider or deployer, with the obligations for each.
Link RoPAs and start DPIAs where personal data is involved.
Tasks, documents and history kept with every system.
Replace scattered AI spreadsheets with one structured workflow. Know what AI you use, how risky it is and what you still owe.
AI governance next to your privacy records
Data mapping
See which vendors provide AI systems, where they are based and whether a DPA is in place.
Explore data mapping AssessmentsDPIA and LIA
Start the DPIA a high-risk AI system needs, with country-specific AI guidance.
Explore assessments RisksRisk management
Track AI-related risks and measures in the same register as your other privacy risks.
Explore risk managementQuestions we get asked
What is an AI Register?
An AI Register is an inventory of the AI systems your organisation builds or uses, with each system’s purpose, vendor, AI Act role, risk level, linked processing activities and outstanding obligations.
Why do we need an AI Register for AI Act compliance?
Your obligations under the EU AI Act depend on which AI systems you use, what you use them for and whether you are the provider or the deployer. You cannot work that out, or show it to anyone, without a reliable inventory.
Does every AI system need to be classified?
Every system should be assessed so you know where it falls. Many end up as minimal risk with no specific obligations beyond AI literacy, but you can only show that once you have checked.
What AI Act risk levels does GDPR Register support?
The register follows the AI Act’s risk-based approach: prohibited practices, high-risk systems, systems with transparency obligations and minimal-risk systems, plus systems not yet classified.
Can GDPR Register help identify high-risk AI systems?
Yes. Guided questions check whether a system is used in an area the AI Act treats as high-risk, such as recruitment, education or credit scoring, and then list the obligations that apply to your role.
Does the AI Register replace legal advice?
No. It structures your inventory, classification and evidence so decisions are consistent and documented, but complex or borderline cases still need legal review.
How does this connect with GDPR and DPIAs?
AI systems are linked to the processing activities that use them. When a high-risk system processes personal data, the register flags the DPIA required under AI Act Art. 26(9) and GDPR Art. 35 and lets you start it.
Can we track third-party AI vendors?
Yes. Each AI system is linked to its vendor in your data map, so you can see which vendors provide AI, where they are based and whether contracts are in place.
Who should use the AI Register?
Privacy and DPO teams, legal and compliance, product and engineering, and management, each with a shared view of AI risk and what still needs action.
Can this help us prepare for client or auditor questions?
Yes. You can show your AI inventory, how each system was classified, the obligations that apply and the evidence and tasks behind them, without assembling it from spreadsheets.
What should we do first if we are just starting with AI Act compliance?
Start with an inventory of the AI tools used across teams and vendors, classify each one, confirm your role, then work through the obligations for any high-risk systems first.
Is this only for large companies?
No. The AI Act applies to organisations of any size that provide or use AI systems in the EU. The register gives smaller teams the same structure without building it themselves.