The records the AI Act expects you to keep

1. 01Providers

   Classification memorandum

   The written record of what your system is and which obligations follow.

   Article 6(4) makes this a legal duty if you conclude an Annex III system is not high-risk: document the assessment before placing the system on the market, register it under Article 49(2), and hand the documentation to authorities on request.

   • Twelve numbered sections, written to be handed to an authority unedited
   • Step-by-step screening: Article 5, Annex I, Annex III, the Article 6(3) filter with the profiling override, Article 50, Chapter V
   • Your dates after Regulation (EU) 2026/1744, with live/upcoming status and the basis for each
   • The obligations that follow, split by provider and deployer role
   • Review triggers, sign-off block, and a closing checklist of what a lawyer should confirm
2. 02Providers and deployers

   Article 50 disclosure kit

   The exact wordings and marking policy for duties that are enforceable today.

   Article 50 sits in Chapter IV and was not deferred — it has applied since 2 August 2026, the day enforcement began. Breaches fall in the 3% penalty tier.

   • Ready-to-paste disclosure wording for chat, voice, email and published content
   • A machine-readable marking policy for synthetic output, with the Article 111(4) grace period applied to your case
   • Emotion-recognition and biometric-categorisation notices, with the Article 5 prohibitions flagged first
   • Deep-fake and public-interest-text disclosures, including the artistic-work and editorial-responsibility limits
   • An implementation log — the evidence that the disclosures exist, which is not the same as them existing
3. 03Deployers

   AI usage policy

   The internal rules that keep everyday AI use out of trouble.

   Most organisations are deployers, not builders. One person screening CVs in a chatbot can put you inside Annex III point 4, and one pasted contract can breach the GDPR before the AI Act is even in play.

   • Ten sections covering scope, the prohibited list, confidentiality, approved tools, human responsibility, disclosure, high-risk duties, incidents and training
   • An approved-tools register pre-filled with the tools you told us are in use
   • The Article 25 trap explained: how buying a system can still make you its provider
   • A staff acknowledgement block you can circulate as-is
4. 04Providers and deployers

   AI system inventory register

   The table every audit, acquirer and authority asks for first.

   No provision says "keep an inventory" — every provision that matters assumes you have one. You cannot register under Article 49 what you have not classified.

   • A fourteen-column register with your assessed system pre-filled from the Navigator
   • A row for each AI tool you listed, so nothing stays undocumented
   • Column-by-column guidance on what goes in and why it is asked for
   • A practical sweep for the systems organisations reliably miss — embedded features, shadow sign-ups, agency-operated tools
5. 05Deployers

   AI literacy plan

   A proportionate Article 4 plan, and the records that evidence it.

   Regulation (EU) 2026/1744 softened Article 4 — it is now a proportionate expectation, not a hard audited duty. There is no mandatory certification, whatever anyone is selling. What helps is a plan you followed and a record with names and dates on it.

   • A role-based matrix scaled to your headcount band
   • A six-to-seven module curriculum, with an overseer module where a high-risk use case is in scope
   • A delivery and records table — the actual Article 4 evidence
   • A printable attendance record

Terms · Privacy · Refunds