Buying an AI tool and supplying an AI product are different activities. A company may do both, with different responsibilities attached to different systems. That is why a single company-wide label is a weak starting point for an EU AI Act assessment.
For UK organisations, territorial scope also needs attention. Assess the actual system, role and deployment against the legal provisions rather than assuming that incorporation outside the EU settles the question. EU AI Act text.
Start with a short register covering each AI use case: its purpose, intended users, supplier or development owner, affected people, important inputs and where outputs are used. Include internally deployed tools as well as customer-facing features.
A product name is not enough. The same underlying technology can support a low-impact drafting task or a decision affecting someone's employment. The intended use and deployment context matter.
Record whether the organisation develops, supplies, deploys, imports or distributes the relevant system, and whether changes to branding or functionality affect that analysis. Mark unresolved questions explicitly and identify who will resolve them.
Then assess applicable obligations. A supplier document pack is useful, but it does not automatically explain the responsibilities your organisation retains.
For each system, capture the next decision: continue with defined controls, restrict a use, request supplier information, perform further assessment or stop an inappropriate activity. Assign a responsible owner and evidence for the decision.
An illustrative record might describe a third-party drafting assistant, the approved information it can process, a human review step and a supplier-change review trigger. That is an example of governance documentation, not a legal classification of every drafting assistant.
The Act has phased application dates and transitional provisions. The Commission maintains a current timeline; do not rely on an old slide saying that all requirements arrive on one date. Already applicable duties should not be ignored because another category has a later date. Commission AI Act timeline.
The register should change when a model, purpose, supplier or user group changes. Build review into procurement and product change processes so the assessment does not become a one-off document.
ProtectifyAI provides EU AI Act readiness support, including inventory, role and obligation mapping. Where you want an organisation-wide management system, explore ISO 42001 implementation; it supports structured governance but does not automatically establish legal compliance.
It can, depending on the system's role, where it is supplied or used, and the Act's territorial provisions. An EU customer alone does not automatically trigger every obligation.
Start with each AI system's provider, deployer, importer or distributor role, intended purpose, users, suppliers and route into the EU market, then map the applicable duties.
Keep the system inventory, role rationale, intended purpose, data and supplier flows, risk classification, responsible owners and review triggers together so changes can be traced.
We'll help you build the register and turn the assessment into clear, owned decisions.
Book a working session →