Start free checkFree check Book a demo

EU AI Act

Every AI system you use, on one register.

The EU AI Act reaches almost every company that builds or uses AI in the EU, not only AI vendors. Fidureon keeps the register: for each system, the risk tier and Annex III category you set, your role as provider or deployer, and the obligations that follow.

Book a demoStart free readiness check
AI Register for a demo company with Export PDF and New AI System buttons: six AI systems in total, three high risk, one limited risk and three in production, with search and filters; beside it the AI assistant pane with an automatic briefing listing one overdue control review and four items due within 30 days.
AI register rows for a demo company: Copilot for office productivity, generative AI, minimal risk; CV screening assistant, NLP, high risk; GridCast load forecasting, machine learning, high risk.
The AI register, with every system’s risk tier beside it and the AI assistant’s briefing, built from what is due for you, on the right. Product screens show a fictional demo company.The AI register: every AI system with its type and the EU AI Act risk tier you set. Product screens show a fictional demo company.

What the Act asks

Four risk tiers, set by what the AI is used for.

The Act sorts AI by what it is used for, not the technology behind it. The same model can be minimal risk in one use and high-risk in another, so the register works one use case at a time.

  1. Prohibited

    Art. 5

    Banned outright. Practices such as social scoring, manipulation that causes significant harm, untargeted scraping of facial images, and emotion recognition at work or in education.

  2. High-risk

    Art. 6

    The heaviest duties. AI that is a safety component of a regulated product, or is used in an Annex III area such as hiring or credit. Requires risk management, documentation, logging, human oversight and conformity assessment.

  3. Limited risk

    Art. 50

    Be transparent. Chatbots and systems that generate or alter content. People must be told they are dealing with AI, and synthetic content must be marked.

  4. Minimal risk

    Art. 4

    No new duties for the tier. Most AI in use today, such as spam filters or demand forecasting. The AI literacy duty still applies, as it does to every tier.

General-purpose AI models, such as large language models, have a separate set of duties for the companies that provide them (Art. 51–55).

The 8 Annex III high-risk areas Used in one of these areas, an AI system is presumed high-risk unless a narrow exception applies. The AI register records the area for every system.
  1. 1 BiometricsRemote identification, biometric categorisation, emotion recognition
  2. 2 Critical infrastructureSafety components in digital infrastructure, traffic and utilities
  3. 3 Education and trainingAdmissions, grading, monitoring tests
  4. 4 EmploymentRecruitment, CV screening, promotion and termination decisions
  5. 5 Essential servicesPublic benefits, credit scoring, life and health insurance pricing
  6. 6 Law enforcementRisk assessments, evaluating evidence
  7. 7 Migration and border controlAssessing applications and risks
  8. 8 Justice and democratic processesAssisting judicial decisions, influencing elections

AI register

One record per system. Your classification on it.

Open any system and its EU AI Act story is in one place: what it is, the tier and Annex III category your team set, your role, and what that tier asks of you.

  • FRIA status See which systems need a fundamental rights impact assessment, and where each one stands.
  • EU database ID Record the EU database registration for each high-risk system, yours or your provider’s.
  • Human oversight and data Who oversees each system and how, and the personal-data categories it touches, linked to your GDPR records.
  • A register you can hand over Export the whole register as a PDF for the board, an auditor or a customer’s due-diligence questionnaire.
AI system details for GridCast load forecasting, a demo company’s machine-learning system in production since 15/12/2025 and developed internally; under Classification, the EU AI Act risk level High Risk, the Annex III category Critical Infrastructure and the provider role Provider, with a note that high-risk AI systems require conformity assessment, EU database registration and ongoing monitoring, and a Create Action button.
  1. Prohibited, high, limited or minimal risk. Your team sets the tier for each use case; the register keeps it with the system.
  2. For high-risk systems, the Annex III area it falls under, such as critical infrastructure or employment.
  3. Provider, deployer, importer or distributor, per system. Many companies are a provider for some systems and a deployer for others.
  4. A reminder of the obligations that follow from the tier you chose, such as conformity assessment and EU database registration for high-risk systems.
  5. Turn what is missing into an action with an owner and a due date, straight from the system’s record.
  1. Risk tier. Prohibited, high, limited or minimal risk. Your team sets the tier for each use case; the register keeps it with the system.
  2. Annex III category. For high-risk systems, the Annex III area it falls under, such as critical infrastructure or employment.
  3. Your role. Provider, deployer, importer or distributor, per system. Many companies are a provider for some systems and a deployer for others.
One AI system’s record: what it is, and the risk tier, Annex III category and role your team set for it.The classification your team set: risk tier, Annex III category and your role.
Registering an AI system: basic facts first, then its classification, purpose, governance and privacy on the next tabs.

Start the register

Add the AI you use, one use case at a time.

Name the system, its type and status, whether you built it or which supplier provides it. Then set its classification and record its purpose, oversight and data on the following tabs.

Not sure where your AI is?

The free readiness check’s EU AI Act track starts by mapping the AI you use. The agent asks how you use AI, and with GitHub connected (read-only) it scans your code for AI models and SDKs and proposes each use case as an AI system for you to confirm. You set the risk tier.

How the readiness check works

Readiness catalogue

The obligations that create work.

23 requirements in 7 categories, from AI literacy and prohibited practices to high-risk technical requirements, provider and deployer obligations, transparency, general-purpose AI and post-market monitoring. Not a copy of every article.

23 readiness requirements In 7 categories, from AI literacy to post-market monitoring
4 risk tiers per system With the Annex III category and your role
38 ISO 42001 Annex A controls Sharing the same AI register
Requirements view for a demo company with EU AI Act 2024.1689 selected as the source and a compliance bar at 35 % (8 of 23 applicable); obligations Art.4 AI literacy, Art.5 No prohibited AI practices, Art.6 AI system inventory and risk classification, Art.9 Risk management system, Art.10 Data and data governance, Art.11 Technical documentation, Art.12 Record-keeping and Art.13 Transparency and instructions for use, each with a description and a status of In Progress, Compliant or Gap.
  1. Pick the EU AI Act, or any other framework you run, in the same view.
  2. How many of the obligations that apply to you are met, counted from their status.
  3. Inventory and classification of your AI systems: the work the AI register holds.
  4. Each obligation carries a status, so what is still open stays visible until the work behind it is done.
  1. Art. 6. Inventory and classification of your AI systems: the work the AI register holds.
The EU AI Act as a readiness catalogue: each obligation with a status, in the same view as your other frameworks.
  • Split by role Provider and deployer obligations sit in separate categories, plus general-purpose AI and transparency.
  • Linked to your controls Link each obligation to the controls and evidence that answer it.
  • A gap report Run a gap analysis and share it as a branded PDF report.

Your role

Providers and deployers carry different duties.

Most companies deploy AI they buy and provide the few systems they build. Many are both. The register records your role per system.

Provider

You develop an AI system, or have one developed, and place it on the market or put it into service under your own name.

For high-risk systems

  • Risk management, data governance, technical documentation and loggingArt. 9–12
  • Quality management, conformity assessment and EU database registrationArt. 17, 43, 49
  • Post-market monitoring and serious-incident reportingArt. 72–73

Deployer

You use an AI system under your own authority at work, including AI you buy from a vendor.

For high-risk systems

  • Use it as the provider instructs, with competent human oversightArt. 26
  • Monitor operation, keep the logs and inform workers before use at workArt. 26
  • Fundamental rights impact assessment, for public bodies, providers of public services, and credit-scoring or life and health insurance useArt. 27

A deployer that puts its own name on a high-risk system, or substantially modifies it, takes on the provider’s obligations (Art. 25). Importers and distributors have lighter duties of their own.

Timeline

When each obligation applies.

  1. Aug 2024

    In force

    The Regulation enters into force. Nothing applies yet; the clock starts.

  2. Feb 2025

    Prohibitions and AI literacy

    Prohibited practices are banned and the AI literacy duty (Art. 4) applies.

  3. Aug 2025

    General-purpose AI

    Duties for providers of general-purpose AI models apply, with the governance structure and penalties.

  4. Aug 2026

    Transparency

    Transparency duties for chatbots and generated content (Art. 50) and most remaining provisions apply.

  5. Dec 2027

    Annex III high-risk

    Obligations for high-risk systems used in the Annex III areas, such as hiring and credit.

    Moved by the 2026 Omnibus

  6. Aug 2028

    High-risk in products

    AI that is a safety component of a product under EU harmonisation law (Annex I).

    Moved by the 2026 Omnibus

Obligations phase in from 2025 to 2028 (dates moved by the 2026 AI Omnibus) — check the official timeline and the Regulation on EUR-Lex before you plan around a date.

This page is a plain-language summary to help you get oriented, not legal advice. The text of the Regulation on EUR-Lex is the authority.

Works with ISO 42001

One register for the law and the standard.

The Act sets what the law requires. ISO/IEC 42001:2023 is the management system for running AI responsibly: 27 clause requirements and 38 Annex A controls, a Statement of Applicability, and the same AI register.

One control can answer both. AI literacy training, for example, meets the Act’s Art. 4 duty and ISO 42001’s competence clause 7.2. Link the control to each requirement, by hand or with AI suggestions when you import controls, and the same evidence counts toward both.

See the ISO 42001 page

Also available: CRA, EU Data Act, PCI DSS 4.0.1, TISAX, MVSP and custom frameworks.

FAQ

EU AI Act questions.

Does the EU AI Act apply to us if we only use AI from vendors?

Usually, yes. Using an AI system under your own authority at work makes you a deployer. Your obligations depend on the system’s risk tier: for high-risk systems they include using it according to the provider’s instructions, assigning competent human oversight, monitoring it and keeping its logs. Whatever the tier, providers and deployers have an AI literacy duty towards the people who use their AI (Art. 4). The Act also reaches companies outside the EU when their AI is used in the EU.

What is the difference between provider and deployer obligations?

A provider develops an AI system, or has one developed, and puts it on the market under its own name. For high-risk systems, providers carry most of the duties: risk management, technical documentation, conformity assessment, EU database registration and post-market monitoring. A deployer uses the system and is responsible for how it is used. Fidureon records your role for each system in the AI register, and the readiness catalogue keeps provider and deployer obligations in separate categories, so each team sees the duties that apply to it.

Does Fidureon decide which risk tier our AI systems are in?

No. Classification is your organisation’s decision. Fidureon gives you a place to make and keep it: for every system the AI register records the risk tier, the Annex III category, your role and who owns it. In the free readiness check, the EU AI Act track starts by mapping the AI you use. The agent asks how you use AI, and with GitHub connected (read-only) it scans your code for AI models and SDKs and proposes each use case as an AI system for you to confirm. You set the risk tier.

Can Fidureon run our fundamental rights impact assessment (FRIA)?

Not as a guided workflow. The AI register tracks FRIA status for each system, so you can see where an assessment is required and how far it has come, alongside the system’s oversight, data and linked risks. The assessment itself is done by your team, or with your adviser.

When do the EU AI Act’s obligations apply?

Obligations phase in from 2025 to 2028 (dates moved by the 2026 AI Omnibus). Prohibited practices and the AI literacy duty apply from February 2025, rules for general-purpose AI models from August 2025, and transparency duties (Article 50) and most remaining provisions from August 2026. The Omnibus moved the high-risk dates: Annex III high-risk systems from December 2027, and high-risk AI in regulated products from August 2028. Check the official timeline before you plan around a date.

How does this fit with ISO 42001 and our other frameworks?

The EU AI Act sets legal obligations; ISO/IEC 42001 is the management-system standard for running AI responsibly. In Fidureon both use the same AI register. You can link one control to requirements in several frameworks, by hand or with AI suggestions when you import controls, and the work counts toward each of them.

Where does Fidureon’s own AI run?

Fidureon is built and operated by CShift AB in Göteborg and hosted on Google Cloud in the EU: europe-north1 (Finland) is the primary region, and evidence files are replicated every day to europe-north2 (Stockholm). The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company. The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.

EU AI Act

Start with the AI you already use.

See your AI register and the obligations for your role on your own systems, or start the free readiness check on its EU AI Act track.

Book a demoStart free readiness check