_1762866128417-DS2_OO1j.png)
Why every company needs an AI register
AI has long arrived in most companies – often unnoticed: as a feature in HR software, as a translation aid, as a website chatbot or as image recognition in quality inspection. The EU AI Act ties obligations to the role (provider, deployer, importer, distributor) and the risk class of a system. Without an overview of all systems in use, none of these obligations can be determined.
Even though the regulation does not explicitly require an inventory, it is the practical first step – and indispensable for an AI management system under ISO/IEC 42001. In addition, the AI literacy obligation has applied since February 2025: whoever uses AI must be trained. For that, too, you need the list of systems and user groups.
What the AI register records
Changes to a system are versioned, so it stays traceable when purpose, risk classification or status changed.
An AI register in four steps
- 1
Collect systems
Ask every area which AI is in use – including AI features in existing software and freely used tools.
- 2
Define role and purpose
For each system, describe purpose and area of use and determine your role.
- 3
Determine the risk class
Check prohibited practices, high-risk use cases (e.g. recruitment) and transparency obligations. Justify the classification.
- 4
Link requirements
For relevant systems, link requirements to evidence and close gaps through policies, training and procedures.
Our guide to EU AI Act obligations for companies provides detailed instructions; the EU AI Act checklist is ideal for a self-check.
Risk classes at a glance
| Risk class | Examples | Typical obligations |
|---|---|---|
| Unacceptable | Social scoring, emotion recognition in the workplace (with exceptions) | Prohibited since 2 February 2025 |
| High | Applicant pre-screening, employee performance evaluation, credit scoring, safety components in products | Extensive obligations for providers; for deployers e.g. human oversight, logs, informing workers |
| Limited | Chatbots, AI-generated content | Transparency obligations, e.g. disclosure of AI interaction |
| Minimal | Spam filters, demand forecasting, translation aids | No specific obligations; AI literacy of users |
The basis for ISO/IEC 42001
ISO/IEC 42001 describes a management system for artificial intelligence (AIMS). It follows the same structure as ISO 9001 and ISO 27001 and can be built into an existing integrated management system. The AI register provides the basis for scope, AI risk assessment and AI impact assessment.
| ISO/IEC 42001 | Requirement | Contribution of the AI register |
|---|---|---|
| 4.3 | Scope of the AIMS | List of AI systems and roles |
| 6.1.2 and 6.1.4 | AI risk assessment and AI system impact assessment | Risk class, purpose and affected people per system |
| 7.2 | Competence | Basis for training per system and user group |
| 8 | Operation | Status and versions of the systems |
More on the ISO 42001 page. Matching policies and procedures are in the template library.
Transparency about our own AI
docxpert itself uses AI, for example for drafts, analyses and the knowledge assistant. These features appear together as the read-only system entry “Docxpert.io Document Intelligence” in your AI register – with purpose, role and risk class. Matching approved documents are linked to the requirements right away. That way you also document the AI you use through docxpert without researching it yourself. AI results in docxpert are always marked as suggestions and require human confirmation.
Frequently asked questions
How often should the AI register be reviewed?
At least once a year and whenever a new AI system is introduced, an existing one is used for a new purpose or is decommissioned. An approval process for new AI tools keeps the register complete.
Is an AI register mandatory under the EU AI Act?
The regulation does not explicitly require an internal inventory. But without an overview, role and risk class cannot be determined – so the register is the practical first step.
Is the AI register the same as the EU database for high-risk AI?
No. The EU database is a public register in which certain high-risk systems must be registered. The AI register in docxpert is your internal inventory of all AI systems.
Do I need to record ChatGPT and similar tools?
Yes, if they are used in the company. As a deployer you have at least the AI literacy obligation and, depending on use, transparency obligations.
How do I determine the risk class?
Check prohibited practices first (Art. 5), then high-risk use cases (Art. 6, Annexes I and III) and finally transparency obligations (Art. 50). Document the rationale.
Can I link evidence to systems?
Yes. For each system you link EU AI Act and ISO 42001 requirements to documents such as policies, impact assessments or training materials.
Who should maintain the AI register?
A designated AI governance function, often working with information security, data protection and business areas.
Which details help classify an AI system again later?
Record more than the product name. Capture the specific purpose, affected processes, user groups, data types and influence on decisions. Note whether the organisation develops or substantially changes the system, or simply uses it, and what the provider says about intended use. Store the risk assessment with its date, owner and reasoned rationale; mark unresolved questions instead of presenting an uncertain classification as settled. Link relevant policies, procurement approvals and impact assessments where they exist. Revisit the entry when purpose, model, data or user groups change. This gives a governance team a basis to explain why the original classification was made and whether it still fits current conditions.