# AI Act role and duty register

Use this to start an AI governance framework under the EU AI Act, Regulation (EU) 2024/1689, as amended by
the Digital Omnibus on AI, Regulation (EU) 2026/1744. Fill in one block per AI system. It works from the
Official Journal text; it is a working aid, not legal advice, so check each classification with your legal
team before you rely on it.

## Step 1: the inventory line

- [ ] System name and owner: ________
- [ ] What it does, and its intended purpose in one sentence: ________
- [ ] Built by us, bought, or built for us by someone else: ________
- [ ] Used in the EU, or its output used in the EU: yes / no

## Step 2: screen and classify

- [ ] Is any use a prohibited practice under Article 5? (applies since 2 February 2025; two more prohibitions from 2 December 2026) yes / no
- [ ] Is it a high-risk system: a safety component of an Annex I product (Article 6(1)), or an Annex III use (Article 6(2))? yes / no / not sure
- [ ] If Annex III but you conclude it is not high-risk under Article 6(3), the assessment is documented before it is placed on the market or put into service: yes / no
- [ ] Does it interact with people, generate synthetic content, recognize emotions, categorize people by biometrics, or make deep fakes (Article 50)? yes / no
- [ ] Is it, or does it use, a general-purpose AI model (Chapter V)? yes / no

## Step 3: settle the role

- [ ] Provider: we develop it, or have it developed, and place it on the market or put it into service under our own name or trademark (Article 3(3))
- [ ] Deployer: we use it under our authority in a professional activity (Article 3(4))
- [ ] Importer or distributor (Articles 23 and 24)
- [ ] Has a deployer, importer or distributor become a provider? Check Article 25(1): our name or trademark on it, a substantial modification, or a change of intended purpose that makes it high-risk: yes / no

## Step 4: the duties, by role

All AI systems
- [ ] AI literacy: measures to support the AI literacy of staff and others operating or using AI on our behalf (Article 4, as amended). Record: ________
- [ ] Transparency to people where Article 50 applies (since 2 August 2026). Record: ________

High-risk, provider (from 2 December 2027 for Annex III, 2 August 2028 for Annex I)
- [ ] Risk management system (Article 9) and data governance (Article 10). Record: ________
- [ ] Technical documentation (Article 11), logging by design (Article 12), instructions for use (Article 13). Record: ________
- [ ] Human oversight by design (Article 14); accuracy and cybersecurity (Article 15). Record: ________
- [ ] Quality management system (Article 17). Record: ________
- [ ] Conformity assessment, EU declaration, CE marking, registration (Articles 16(f) to (i), 43, 47, 48, 49). Record: ________
- [ ] Post-market monitoring and serious incident reporting (Articles 72 and 73). Record: ________

High-risk, deployer (same dates)
- [ ] Use in line with the instructions for use (Article 26(1)). Record: ________
- [ ] Human oversight assigned to people with the competence, training and authority (Article 26(2)). Record: ________
- [ ] Input data relevant and representative, where we control it (Article 26(4)). Record: ________
- [ ] Monitor operation; inform the provider; suspend and report where there is a risk or a serious incident (Article 26(5)). Record: ________
- [ ] Keep the logs under our control for at least six months (Article 26(6)). Record: ________
- [ ] Inform workers' representatives and affected workers before workplace use (Article 26(7)). Record: ________
- [ ] Use the provider's information for any GDPR data protection impact assessment (Article 26(9)). Record: ________
- [ ] Tell people subject to Annex III decisions that the system is used (Article 26(11)). Record: ________
- [ ] Fundamental rights impact assessment, if we are a public body, provide a public service, or use an Annex III point 5(b) or (c) system (Article 27). Record: ________

Sources: Regulation (EU) 2024/1689 (http://data.europa.eu/eli/reg/2024/1689/oj); Regulation (EU) 2026/1744
(http://data.europa.eu/eli/reg/2026/1744/oj). Read 20 October 2026. From Credential Press, credentialpress.com.