EU AI Act
A register of every AI system in your company: vendor, area of use, owner — and per system the risk class every other obligation follows from. Most companies find more than they expected.
AI Act (EU) 2024/1689 · Art. 4 in force since 02/02/2025, high-risk obligations from 02/08/2026
AI inventory
Your role
The regulation knows four roles, and they do not exclude one another: pass a bought-in system on under your own name and you turn from deployer into provider, with markedly more duties. Eight questions settle where you stand.
Provider
develops or places on the market
Deployer
uses under own authority
Importer
brings in from third countries
Distributor
makes available unchanged
The same company can be deployer for one system and provider for another — which is why the check runs per system, not per company.
Every system with vendor, area of use, owner and contract status. The risk class sits on each row, and whatever is not yet classified shows up as such instead of slipping through.
The models come from outside; responsibility for using them stays with you. Scattered emails become a log with status, response rate and archived evidence — including when a vendor refuses to answer.
Article 4 requires sufficient AI literacy among the people operating your systems — in force since 2 February 2025, for everyone, regardless of risk class. The tracker turns that into a log instead of a claim.
Once the risk class is set, so is the list: transparency notices, human oversight, technical documentation, EU registration, fundamental rights impact assessment and serious-incident reporting — each with its reference.
Try it
The risk class is the hinge of the whole regulation: every other obligation follows from it. And it cannot be guessed, only worked through — prohibited practices under Article 5, high risk under Annex III, transparency duties under Article 50.
This is the very wizard customers use inside the product. It is fully available here: answer the questions, read the classification. Only the result is not saved, because saving it needs an account and a system to attach it to.
Demo
Bring a list, or just the three tools that come to mind. We enter them during the call, classify them and show which obligations follow — and which deadlines are already running.
About 30 minutes. Reguly is not a substitute for legal advice; the classification is reasoned preparation.
The same platform carries the packaging and passport obligations. All three regulations at a glance.
Questions
No. It is structured, reasoned preparation — every question with its reference. What follows from it belongs in front of a lawyer; Reguly is not a substitute for legal advice.
Yes. Anyone using an AI system under their own authority is a deployer and has duties — at minimum AI literacy under Art. 4, and for customer-facing systems the disclosure under Art. 50.
Sufficient AI literacy among the people operating your AI systems. No scope is prescribed — you still have to evidence it. The duty has applied since 2 February 2025.
The fundamental rights impact assessment under Art. 27 applies to certain deployers of high-risk systems, not to everyone. Reguly flags when a system falls under it and walks you through the assessment.
No. The report stays your action. Reguly prepares it in full — facts, timestamps, affected system and evidence — and logs what was reported when.
Yes, and that is the normal case. Pass a bought-in system on under your own name and you become its provider. That is why the role is checked per system, not per company.
It is archived, not deleted. The classification, the obligations list and the evidence remain — in an audit, what you used to run counts too.
Bereit anzufangen?
The inventory is the one thing that comes before everything else. Set it up — free and without a credit card.
Reguly is not a substitute for legal advice.
