EU AI ACT / RULE REFERENCE

AI Act — model inventory & risk tiers

The AI Act (Regulation 2024/1689) is risk-tiered: prohibited practices, high-risk systems with heavy obligations, limited-risk transparency duties, minimal-risk free use — plus a separate regime for general-purpose models. Every obligation assumes you can first answer one question: which AI systems do you run, and in what role? A provider and a deployer of the same model carry different duties — most organisations are both.

The rule

Providers and deployers must know which AI systems they operate, classify them by risk tier, and maintain the documentation trail proportionate to that tier.

What it means for how you build

Start with a registry: model, provider, risk tier, data provenance, oversight control. You cannot document what you have not inventoried.

Self-check

Is there a registry of every AI system in production — model, provider, version, use-case?
Is each entry classified by role (provider vs deployer) and risk tier?
Are prohibited practices affirmatively ruled out and documented?
Does the registry emit audit events on registration and tier changes?

Common pitfalls

"We don’t do AI": embedded vendor features — CV screening, support chatbots, code assistants — make you a deployer anyway.
Tier-by-instinct: risk classification is defined in the Annexes, not by gut feel.
A registry kept in a slide deck goes stale — the inventory is an operational record, not a presentation.

How the engine checks it

Model registry endpoints — risk-tiered inventory with audit events on registration and tier changes.

Sources

AI Act — Regulation (EU) 2024/1689 (EUR-Lex)

Related rules

Last reviewed 2026-11-01.