Summary
- Inventory models and embedded features by use case, owner, data, decision impact and geography.
- High-risk controls need evidence, monitoring, human oversight and incident handling that survive vendor change.
The EU AI Act reshapes the landscape through duties that vary by role and risk, rather than one rule for all software. Organisations should map whether they provide, deploy, import or distribute each system and stop treating procurement labels as legal classification. The next useful evidence is a living register tied to technical files, staff training, logs and retirement dates. Compliance becomes useful when the same record helps teams answer who can intervene and what happens when the system fails.
