AI Act: The Inventory of AIs, Key to Compliance

Respecting the AI Act requires a long-term commitment: every time a new tool is introduced, a supplier changes, or a general-purpose model is adopted, a requalification is necessary. It is mandatory to be able to prove which tools are used, for what purpose, at what level of risk, and under whose authority, while multiple uses remain off the management's radar. The governance framework is complemented by mastering the challenges of AI and aligning with the GDPR.

Continuous compliance with each new tool

Compliance with the AI Act is not a project that can be closed. Each new tool, any change in supplier, or the integration of a general-purpose model necessitates a new qualification. Companies that fare best are those that make this process a reflex rather than trying to quickly tick off a list. Knowing precisely what is being used, why, with what guarantees, and under what responsibility conditions the choices of use or non-use of AI.

First, know what is running: inventory reveals uses

In many organizations, the number of AI tools actually employed is only estimated. The conversational assistant managed by the IT department is usually identified, but solutions adopted by a marketing department are less so, and modules like a recommendation engine integrated into HR software for two years may never have been examined. The initial inventory often reveals tools for sorting applications, document analysis software, or embedded models that have gone unnoticed by the IT department or the legal department. The AI Act prompts companies to question what is actually functioning internally: it does not create these uses but highlights them and draws consequences.

Demonstrate, classify, and situate responsibilities

The European regulation does not require ticking boxes but rather being able to demonstrate which systems are used, their purpose, their level of risk, and the associated responsibility. In practice, the use of a checklist has become widespread to structure this demonstration, starting with an inventory phase. The next steps vary according to categorization into four risk levels, ranging from prohibited uses to those with minimal risk, and according to obligations that differ based on the role played—supplier, deployer, importer, or distributor—in the value chain. A company that uses AI to support its recruiters without entrusting the final decision to the machine must be able to prove that this use is not considered high risk or demonstrate its compliance with applicable requirements, anticipating this justification before any audit.

Train users and avoid silos with the GDPR

Beyond procedures, there is a requirement for AI literacy: users must understand the limitations, possible biases, effects on personal data, and their share of responsibility. Building a common culture offers protection equivalent to that of a procedure. The AI Act does not replace the GDPR: as soon as a system processes personal data, the legal basis, data minimization, informing the affected individuals, and, in some cases, conducting an impact assessment must always be respected. Organizations already rigorous about the GDPR have an advantage, provided they avoid creating silos, for example, with two registers managed separately by teams that do not communicate. Taken seriously, the AI Act can become a governance tool, just as the GDPR has become for many companies.