Which systems belong in the AI inventory?

Every piece of software that produces results from inputs on its own: purchased AI tools, AI functions inside existing standard software and in-house developments, even where they build on a third-party model. Embedded functions get an entry of their own. Pure data holdings belong in the asset register under the asset type “AI training data”, and hard-coded logic without a learning component stays out. When in doubt, include a system; the classification sorts out uncritical cases in a few clicks.

Why is “Save & Continue” greyed out?

On the Purposes of Use page every system needs at least one purpose. On the Roles and system risk page, every system with follow-up questions needs all of them answered, plus the profiling question and, where required, the justification once a case group is confirmed. On the Classification Result page both must be complete together. The yellow note above the footer names the reason. “Save as Draft” works at any time on all three pages.

Can I change the calculated risk class?

Yes. The pencil icon next to the risk class opens the “Adjust classification” dialog. The justification is a mandatory field with a minimum length and should name the trigger concerned, the reason for the deviation and the source of the assessment. The adjusted class takes effect immediately, the calculated class stays documented alongside it, and the table shows the “Manually adjusted” badge. “Remove adjustment” returns the system to the calculated classification.

What happens when a system changes later?

In the AI register, use “Record substantial change” to note what has changed. The system receives the “Re-assessment needed” badge; the existing classification stands until you repeat the run on the classification pages and confirm again on the Classification Result page. Every confirmation extends the version chain of the record, and the earlier state remains visible.

What does a prohibited use in the result table mean?

If a prohibited practice applies, a red box appears in the expanded row and the practice is shown in red in the “What follows from this” column. Where the prohibition is already in force, the use is unlawful today; where it takes effect later, the box names the date. You can still confirm the result so that the finding is documented, and the system is recorded as blocked. Check whether the use can be reshaped into a lawful one, adjust the purpose entries and confirm again.

Record, classify and register AI systems

In the AI Compliance Assistant you record your AI systems in the Inventory & Classification chapter. On the AI Inventory page you add every system as an asset, under Purposes of Use you select what it is actually used for, under Roles and system risk you answer the sourcing form, the role questions and product safety, and on the Classification Result page you confirm the risk class for all systems in one go. The AI Register then shows, per system, which obligations of the AI Act apply and from when.

Open the chapter and record AI systems

Start Inventory & Classification

Open the AI Compliance Assistant from the sidebar and click the Inventory & Classification row in the chapter list. The entry page explains in three cards what the chapter produces: AI inventory, Classification and AI register. Next takes you to the AI Inventory page.

Add systems from the catalogue

The Commonly used AI systems box lists common tools grouped by AI technology. One click on an entry creates the system as an asset of the type “AI algorithms / models” in the asset register, creates the vendor as an asset of its own and links the two. For devices without a fixed brand, such as an AI conference camera, Cenedril first asks for the manufacturer; Apply and create completes the entry. If an asset with the same name but a different asset type already exists, a yellow note appears: Manage as AI system converts the existing asset, Dismiss leaves it untouched.

If other assistants have already contributed tools, the Suggestions for your AI inventory box appears above the catalogue. Each suggestion shows its origin (From the Data Privacy Kickstarter, From the ISMS Wizard or From the scope), and Add links the existing asset without creating a duplicate. Suggestions from the scope are derived from the providers linked there: add only what actually runs in your organisation.

The four ways to an entry: catalogue, template by technology, self-hosted open model and manual entry. A catalogue entry creates the system and its vendor as assets.

Record your own and self-hosted systems

Three further ways cover systems without a catalogue entry. Record your own AI system by technology opens the entry form with the AI type pre-set and a pre-filled name, for instance for your own forecasting model. Record a self-hosted open model is for openly licensed models on your own hardware; hosting location, integration and sourcing form are pre-set, and there is no vendor. Record AI system manually opens the Record AI system form with the fields Name (required), Vendor / manufacturer and Intended purpose; Add creates the asset. The intended purpose later appears in the header of the system card on the classification pages.

Check the list and set the reminder

The Your AI systems table lists every system with Name, Vendor and AI type. Asset details opens the asset’s master data, such as model type, model version and deployment model; for the classification, name, vendor and purpose are enough. In the Annual inventory and classification review box, Set reminder (yearly) creates the recurring appointment, pre-filled with the people holding the “AIMS Operation” AI role.

Click Save & Continue. The button requires at least one system in the list and leads to the Purposes of Use page; Save as Draft saves the state even with an empty list.

Select purposes of use

Tick the actual use per system

The Purposes of Use page shows every system as a card with name, vendor and intended purpose in the header and, below it, the open list of catalogue purposes with examples. Systems from the catalogue arrive with pre-selected purposes; compare the pre-selection with the use in your organisation. Multiple selection is the normal case, because across all purposes of a system the purpose with the strictest classification counts later. As soon as a purpose is ticked, notes appear below it saying which transparency duty it triggers and whether follow-up questions follow on the next page.

If no catalogue entry fits, create your own purpose via Create your own purpose. The dialog asks the basic questions of the assessment tree, and the purpose then carries the Custom purpose badge.

Continue to Roles and system risk

Save & Continue only becomes active once every system carries at least one purpose; until then the note Please select at least one purpose of use for each system. sits above the footer. The button stores a draft and opens the Roles and system risk page. Nothing is published in this run before the Classification Result page; until then you move freely between the three pages, and Back saves the interim state as well.

Determine role and system risk

Answer the sourcing form and the role questions

Every card starts with the Your role for this system block. In the How did you obtain this system? field select the sourcing form, from Finished vendor product, obtained as a service through Open model with your own application built around it to In-house development without a third-party base model. A line below the field says whether the provider or the deployer role follows from it. Then check the two pre-set questions: Do you pass this system on to other organisations as a product, sell it or distribute it? stands at No, Do you use the system within your own organisation? at Yes. For providers, further questions follow, for example whether the system is a general-purpose AI model that you provide yourself.

Classify the link to product safety

The Product safety block appears for every system because it opens its own path into the high-risk classification. Choose one of the three options: No link to Annex I, Safety component of an Annex I product or The system is itself an Annex I product. For the safety component, two yes/no questions follow that can close the path again. In both Yes cases you select the legal act under Which Union harmonisation act applies?, pre-filled with the acts from the organisational context. Missing answers in this block do not stop Save & Continue; so go through it deliberately.

The sourcing form select determines the role, the three options under “Product safety” the path via Annex I. The legal act selection appears only for a safety component or an Annex I product.

Answer the follow-up questions and the derogation

If a selected purpose touches a sensitive field of use, the card shows the Follow-up questions on the intended purposes block. Answer each question with Yes or No; the grey line above it names the triggering purpose, and Show explanation draws the boundary of the element. After a confirmed high-risk element, the A derogation may apply block unfolds with four case groups. Only once you confirm a case group does the profiling question appear, and only with profiling denied does the Justification field appear; with profiling confirmed the system stays high-risk. For every high-risk system the Grandfathering block follows in addition, and for a high-risk third-party system also the questions under Do the ways you handle this system make you its provider? (Art. 25).

Check role and preliminary risk

At the end of each card stand This results in the role: and Preliminary system risk:. If the role does not match what you know about the system, the error lies in one of the answers above. Save & Continue becomes active once all questions are answered for every system with follow-up questions, and leads to the Classification Result page.

Confirm the classification

Read the result and its derivation

The Classification Result page shows all systems in a table with the columns System, Risk class, Role and What follows from this. Click a row to expand Why this classification?. Under Established: you see nothing but your own entries, that is the selected purposes and the questions answered with Yes; under What follows: stand the obligations with the legal reference they rest on. If a statement under Established: is wrong, use Back to return to the previous page and correct the entry; the classification then recalculates.

The expanded row shows your own entries under “Established” and the obligations with legal reference under “What follows”.

Adjust the classification if needed

The pencil icon next to the risk class opens the Adjust classification dialog. Choose the Risk class and enter a Justification with a minimum length; Apply adjustment makes the class effective immediately. The table then shows the Manually adjusted badge with your justification, and the calculated class stays documented alongside it. Remove adjustment returns the system to the calculated classification.

Confirm the run for all systems

On this page Save & Continue is the confirmation of the whole run. The button only becomes active once purposes and follow-up questions are complete for every system; otherwise a note above the footer names what is missing. One click writes the effective risk class, the role, the purposes and the classification date to each system’s asset in the asset register and creates a versioned record of the classification per system. Cenedril reports Classification completed and documented on the AI system. and opens the AI register. Save as Draft preserves the state including your adjustments without publishing anything.

See the obligations in the AI register

Expand the obligation list per system

The AI Register lists every system as a card under All AI systems: name, vendor and role in the header, the risk class and the regulatory usage status on the right, and below them Classified on and the number of applicable obligations. Clicking the obligation count, for example 9 obligations apply, expands Obligations relating to this system. The obligations are grouped by the date from which they apply, Already in force first, then In force from with the respective date; a prohibition under Art. 5 sits above them in red. The list deliberately has no checkboxes: the obligations are worked on on the Implement AI controls page in the Rules, Competence & Implementation chapter, where each obligation becomes a task with a responsible person. If the classification requires a fundamental rights impact assessment, the card carries the Required badge.

The obligation list per system, grouped by the date from which they apply: “Already in force” first, then the groups with a future date. There are no checkboxes here; the work happens on the “Implement AI controls” page.

Complete the chapter

Below the obligation list follow the blocks in which the register itself is maintained, starting with Responsibility and documents. How to fill in these blocks is described in the guide “Maintain the AI register”. To complete the chapter, Save & Continue is enough: Cenedril updates the AI register record and returns to the overview of the AI Compliance Assistant.

Result: every AI system is an asset in the asset register, each carries role, risk class and classification date, a versioned classification record exists per system, and the AI register shows the applicable obligations by the date from which they apply. The Risks & Impact Assessment and Provider Obligations chapters build on exactly these values.