Your AI system register, classified by AI Act risk

Regulation (EU) 2024/1689 applies to any organization that develops, places on the market or uses an AI system in the Union — including non-EU companies whose output is used in the EU. Most companies are caught as deployers: they use AI tools built by third parties. See the deployer obligations.

Application is staggered: prohibited practices since 2 February 2025; general-purpose AI (GPAI) obligations since 2 August 2025; the Article 50 transparency duties and the general regime on 2 August 2026; high-risk systems embedded in regulated products (Annex I) on 2 August 2027.

Article 99 sets three caps: €35M or 7% of worldwide annual turnover for a prohibited practice; €15M or 3% for breaching other obligations — including deployer duties and Article 50; €7.5M or 1% for supplying incorrect information to authorities. The higher figure applies, except for SMEs and start-ups where the lower one does. Being unable to produce your AI inventory during an inspection falls into the second category.

The provisional « AI Omnibus » agreement (May 2026) introduces a transition for Article 50(2): generative AI systems already placed on the market before 2 August 2026 would have until 2 December 2026 to satisfy the machine-readable marking requirement for synthetic content. The duty to disclose that a person is interacting with an AI is not postponed. Until the final text appears in the Official Journal, plan for 2 August 2026.

No — not if you are a private company. Article 49 reserves registration in the EU database for providers of Annex III high-risk systems and for deployers that are public authorities, Union institutions, bodies, offices or agencies. A private company that merely uses a high-risk system is not covered. Your register still is the instrument of proof for the duties that do bind you: AI literacy (Art. 4), prohibited practices (Art. 5), deployer obligations (Art. 26), transparency (Art. 50) — and the foundation of an ISO/IEC 42001 or GDPR impact assessment. We would rather tell you than sell you an obligation that does not exist. Read the detail.

A provider develops an AI system or places it on the market under its own name; a deployer uses it under its own authority in a professional context. Most companies are deployers. Heavily customising a system, rebranding it or changing its purpose can flip you into provider status (Article 25), with far heavier obligations — the tool flags this shift.

Systems listed in Annex III and those embedded in already-regulated products (Annex I): recruitment and worker management, access to education, credit scoring, essential services, biometrics, law enforcement, critical infrastructure. They require risk management, data governance, technical documentation, human oversight and registration. See the risk levels in detail.

Never. No content script, no URL stored: only the tab's domain name is compared, in memory, against a built-in catalog of AI tools. Unknown sites leave no trace, and your register, detections and settings stay in your browser. Nothing is sent to a server.

No. AI Act Register Pilot is a mapping and compliance-support tool. The suggested classification is indicative and based on public metadata; the definitive qualification of risk and of your role is yours to make, with your legal counsel where appropriate.

Google Chrome and Chromium-compatible browsers, via the Chrome Web Store, in English and French.