Enterprise AI register: what it contains and what it is for

Why keep a register

The AI Act's obligations do not apply to "AI" in general. They depend on each system and on its use. An assistant that summarises meetings and a tool that screens job applications do not carry the same rules. The second falls in principle under high risk (Annex III, point 4); the first does not.

To know which rules apply, you first need to know which AI systems are running. That is the register's job. Without it, none of the other questions of AI governance has an answer.

The regulation does not use the word "register" for an internal inventory, and does not prescribe one under that name for every company. But each of its obligations concerns a specific system: without an inventory, you cannot show you have examined them.

Not to be confused with the EU database

The AI Act creates a European database. Providers register the high-risk systems listed in Annex III there. Public authorities that deploy them register their use (Article 49). A private company that deploys a system has no such registration duty, unless it acts on behalf of a public authority. Its internal register remains its own.

What a register contains

The AI systems that get forgotten

A register is only worth something if it is complete. Three families often escape the inventory:

• individual accounts, opened by employees without going through IT;
• features switched on by an update to software already in place;
• AI built into a software suite, which cannot be connected. It still enters the register: the regulation asks you to govern it, not necessarily to measure it.

The AI literacy obligation (Article 4) concerns the staff who use AI systems. The register also says who uses them.

From register to evidence

A register kept in a spreadsheet shows the state of the day. In front of an inspector, you need to show what was true on a past date: when a system was classified, by whom, on what basis. That is why the risk class must be kept over time and every piece of evidence dated. The AI Act compliance page sets out which evidence to attach to each obligation.

How to build it

1. Declare. A few questions per AI system: purpose, owner, vendor. The register fills itself.
2. Classify. The risk class under the AI Act, and the obligations that follow.
3. Connect what can be connected. A connected AI system is measured, not just declared.

In the Cockpit, the register, the risk classes kept over time and the dated evidence sit in one place, whatever the vendors. The Factory is the offer designed to connect the systems already in place.