Legal counsel at a mid-sized care organisation gets an email from the board secretary: "I read that an AI register is becoming mandatory. Do we have one?" She opens the AI Act and searches for "register". She finds an EU database, an obligation on providers, something about public authorities, and nowhere an article saying her organisation has to keep a list.
That is correct. The AI Act does not require every organisation to keep one universal AI register in a prescribed form. What it does require depends on two things: which role you have (provider or deployer) and which systems you deploy. Where personal data is processed, the GDPR record of processing comes on top. And separately from all of that, many organisations keep an internal register for a reason that has nothing to do with any article of law.
What does the AI Act actually require?
The AI Act distinguishes the provider, who develops an AI system or places it on the market under its own name, from the deployer, who uses the system under its own authority. Most organisations are the second: they use Copilot, a chatbot or a transcription tool from a vendor.
The registration duty sits with the provider. Article 49 requires providers of high-risk systems from Annex III (think AI for recruitment, employee evaluation or access to public services and benefits) to register the system in the EU database of Article 71 before placing it on the market. For deployers, that duty applies only if they are a public authority or act on behalf of one: they register their use of such a system in the same database.
Other deployers of high-risk systems have no registration duty, but they do have documentation duties, in Article 26: use the system in line with the instructions for use, assign human oversight to people with the competence and authority to carry it out, keep the automatically generated logs (for at least six months, to the extent they are under your control), and inform workers before the system is put to use in the workplace. An organisation that complies keeps something that resembles a register in practice. But it is documentation per system, not one list of everything.
Since the Digital Omnibus, those obligations apply from 2 December 2027 for Annex III, and from 2 August 2028 for high-risk AI in regulated products (Annex I). The full calendar is in the AI Act timeline after the Digital Omnibus. What already applies: the transparency obligations of Article 50 since 2 August 2026, and the duty to support AI literacy among staff under Article 4 since 2 February 2025.
And the GDPR?
The GDPR was always separate from this, and it does not move. If an AI tool processes personal data (summarising a job application, answering a customer email), that is a processing operation, and Article 30 GDPR requires a record of processing activities: purpose, categories of data subjects and data, recipients, retention period, security measures. The exemption for organisations with fewer than 250 employees is narrow: it falls away as soon as the processing is not occasional or touches special categories of data, and AI use at work is rarely occasional.
That record of processing is not an AI register. It describes the processing, not the system. How the two relate and what you record in an AI register is in an AI register: what it is and what you record in it. How the AI Act and the GDPR work side by side is in what does the AI Act mean for my business, alongside the GDPR.
The Dutch Algorithm Register for public bodies
For Dutch public bodies there is one more thing: the Algorithm Register at algoritmes.overheid.nl. The national government asks public organisations to publicly describe impactful algorithms and high-risk AI systems there, so that citizens, regulators and journalists can see which algorithms government uses. Whether and when that becomes a statutory duty is an open political question; check the site itself for the current position. For companies there is no comparable public register.
The whole picture:
| Obligation | Who | What | From when |
|---|---|---|---|
| Registration in the EU database (Article 49 AI Act) | Providers of high-risk systems from Annex III; public authorities deploying such a system | Register the system, or its use | With the high-risk obligations, 2 December 2027 |
| Deployer duties (Article 26 AI Act) | Any organisation deploying a high-risk system | Use per instructions, human oversight, keep logs, inform workers | 2 December 2027 (Annex III), 2 August 2028 (Annex I) |
| Record of processing (Article 30 GDPR) | Every controller, with a narrow exemption below 250 employees | All processing of personal data, including via AI tools | Already applies |
| Dutch Algorithm Register | Dutch public bodies | Publicly describe impactful algorithms and high-risk AI | At the request of the national government |
| Internal AI register | Nobody is required to | Which AI tools are in use and what has been decided about them | Own choice |
Where does the care organisation end up?
Back to legal counsel. Two things are happening at her organisation at once. HR wants to deploy a tool that pre-sorts job applications. That is an Annex III application, so from 2 December 2027 the Article 26 duties apply: human oversight, logs, informing workers, and the provider must have registered the system in the EU database.
Meanwhile some forty colleagues use a writing assistant for letters to clients. That is not a high-risk system, and the AI Act asks for no registration. But personal data goes in, so that processing belongs in the record of processing, with a data processing agreement underneath. And the organisation does not know which other tools are in use next to that writing assistant. That last point is in no law at all, and it is exactly the question the board secretary was asking.
Why organisations keep one anyway
Because without a register you have no answer to the first question every regulator, auditor or board member asks: which AI do you use, and what have you decided about it? The record of processing does not answer that, because it is about data, not tools. And the AI Act obligations start from a classification you can only make once you know which system you are holding.
An internal register is therefore not a legal requirement, but it is the precondition for meeting the requirements that do exist. The weakness of such a register is that it describes what someone reported, not what is actually being opened. BeeSensible places the use observed in the organisation next to its catalogue of 865 assessed AI tools: only the domain, at most once per day per device, with no user id. An administrator sees which tools still have no decision and records that decision; BeeSensible never takes that decision itself.
