01Art. 26 · deployer register
AI Inventory
Every AI system in use, including the unapproved ones, in one maintained register.
The problem
Regulated firms already use AI in decisions about people
The duties are live, but many firms have no one whose job it is to meet them.
01What they are asked for
02Who carries it today
03What is missing
A register of every AI system in use
A head of risk and compliance who already owns three other regimes
An AI ethics committee or a model-risk team
A risk classification for each system, against Annex III for the sectors they operate in
The managing director, CIO or CISO
Governance tools priced and built for firms their size
A fundamental rights impact assessment for the high-risk use cases
The one operations or HR lead who does compliance alongside everything else
The artefacts an auditor asks for, rather than another framework
An AI literacy record for staff, a board pack and an audit trail
For a supplier, whoever answers the customer's questionnaire
A person who will stand behind the evidence
01What they are asked for
- A register of every AI system in use
- A risk classification for each system, against Annex III for the sectors they operate in
- A fundamental rights impact assessment for the high-risk use cases
- An AI literacy record for staff, a board pack and an audit trail
02Who carries it today
- A head of risk and compliance who already owns three other regimes
- The managing director, CIO or CISO
- The one operations or HR lead who does compliance alongside everything else
- For a supplier, whoever answers the customer's questionnaire
03What is missing
- An AI ethics committee or a model-risk team
- Governance tools priced and built for firms their size
- The artefacts an auditor asks for, rather than another framework
- A person who will stand behind the evidence
Regulatory timeline
The calendar is set in law
The AI Act is the deadline most firms know about. For regulated firms it arrives alongside DORA, NIS2, CER and the second Consumer Credit Directive, often from the same supervisors and through the same supply chain.
- 02 Feb 2025In forceEU AI ActAI literacy duty (Art. 4) and prohibited practices (Art. 5)
- 27 Jul 2026AdoptedAI OmnibusRegulation (EU) 2026/1744 in force: the high-risk dates are confirmed
- 02 Aug 2026In forceEU AI ActTransparency duties (Art. 50) and the penalty regime
- 20 Nov 20262 weeksCCD2The second Consumer Credit Directive reaches consumer lenders across the EU
- 02 Dec 202713 monthsEU AI ActAnnex III high-risk duties: credit, life and health insurance, employment
- 17 Jan 202814 monthsDORADORA applies to Irish credit unions
- 02 Aug 202821 monthsEU AI ActAnnex I high-risk duties for AI inside regulated products
Four regimes that overlap through the supply chain
Obligations under the AI Act, NIS2, CER and DORA overlap, and flow down by contract to suppliers, contractors and essential services.
EU AI ActSafe use of AI
- Literacy and transparency duties apply now
- High-risk duties from December 2027
- Applies to deployers as well as builders
NIS2Cybersecurity
- Reaches suppliers through contracts
- Board approval and personal liability
CERCritical entity resilience
- Irish designations under way
- Operational disruption readiness
DORAFinancial ICT resilience
- Third-party ICT rules since January 2025
- Applies to credit unions from January 2028
Platform v1
Explore the platform →A platform built for firms with a small governance team
The platform keeps the governance record live, so whenever someone asks, the answer is current and the evidence is in one place.
02Annex III · Art. 6
Classification
Each system classified against Annex III, with the provider or deployer role recorded and the uncertain cases reviewed by a person. The same answers always give the same result.
03Art. 27
FRIA
A fundamental rights impact assessment for each high-risk system, with cited evidence and documented mitigations.
04Arts. 4 and 26
Evidence Locker & AI Literacy
Versioned governance evidence, and the staff literacy record the Article 4 duty needs.
05Art. 26 · third-party AI
Obligations & Policies
Obligations tracked from a template library, policies mapped to your sector regulator, and due diligence on the third-party AI you rely on.
06Art. 26(6) · log retention
Audit Packs
Board and audit packs generated from the live state of your governance, in language a board can sign and an auditor can read.
Trust layer
- Hosted on AWSThe platform runs on Amazon Web Services.
- ISO 27001 and SOC 2Certification under way, for Q1 2027.
- One source for regulatory datesEvery deadline in the platform comes from a single maintained register.
Services
The platform, with people behind it
Services come first, and the platform is part of every engagement from the first contract.
- 01TrainMasterclass and literacyA board session and role-based literacy that discharge the Article 4 duty and leave a record.
- 02AssessExposure assessmentEvery AI system found and classified, the provider or deployer question settled, and a prioritised exposure report.
- 03BuildImplementation bundleInventory, classification, policies, assessments and the first board pack, set up on the platform with training included.
- 04RunPlatform subscriptionThe governance record kept live: obligations tracked, evidence versioned, exports the board can sign.
- 05SustainCompliance as a ServiceA fractional AI governance officer with a set number of hours each month: monthly reviews, quarterly board packs and a named person to call.
Who we work with
Regulated firms, and the suppliers they depend on
01Insurers and intermediariesBrokers, MGAs and smaller insurersThe EIOPA Opinion sets expectations for AI governance now, including third-party AI. Life and health pricing is high-risk from December 2027.Insurance guide 02Lenders and credit decisioningCredit unions, retail credit firms and non-bank lendersCreditworthiness assessment is high-risk from December 2027. CCD2 applies sooner, from 20 November 2026.Financial services guide 03Regulated enterprises and their suppliersUtilities, pharma, medtech, banks and insurersThey must govern the AI and ICT their suppliers provide, and suppliers must be able to answer their questions.Talk to us 04Employers and HRHiring teams, recruiters, and any firm whose staff already use AIAI in hiring, performance management or task allocation is high-risk from December 2027, including features already switched on in HR software. Literacy and transparency duties apply today.Employment and HR guide