AI Act: where to start with your inventory of artificial intelligence systems

A risk-based regulation

The AI Act classifies systems by risk: prohibited practices, high-risk systems, systems with transparency obligations and minimal-risk systems. Prohibitions and the AI literacy obligation have applied since February 2025, and the rules on general-purpose AI models since August 2025. Deadlines for high-risk systems are under review at European level: it pays to prepare without waiting.

The first step: the inventory

Many organisations use AI without knowing it: features embedded in business software, assistants in productivity suites, cloud services. A reliable inventory identifies, for each system, its purpose, the data processed, the provider, the organisation’s role (provider or deployer) and the risk class.

From classification to governance

1. List the AI systems in use and in development.
2. Classify them according to the AI Act risk categories.
3. Define usage policies, responsibilities and human oversight.
4. Train staff in the responsible use of AI.
5. Integrate AI into the management system, including under ISO/IEC 42001.