The legal counsel at a mid-sized care organisation gets an email from the board secretary: "I read that an AI register is becoming mandatory. Do we have one?" She opens the AI Act and searches for "register". She finds an EU database, an obligation on providers and something about public authorities, but no article saying her organisation has to keep a list.
She has read it correctly. The AI Act does not require every organisation to keep a single, universal AI register in a set format. What it does require depends on two things: your role (provider or deployer) and the systems you deploy. Where personal data is processed, the GDPR record of processing applies as well. And quite apart from all that, many organisations keep an internal register for a reason that has nothing to do with any legal provision.
What does the AI Act actually require?
The AI Act distinguishes the provider, who develops an AI system or places it on the market under its own name, from the deployer, who uses the system under its own authority. Most organisations fall into the latter group: they use Copilot, a chatbot or a transcription tool from a vendor.
The duty to register lies with the provider. Article 49 requires providers of high-risk systems listed in Annex III (AI for recruitment, employee evaluation or access to public services and benefits, for example) to register the system in the EU database set up under Article 71 before placing it on the market. Deployers have that duty only if they are a public authority or act on behalf of one, in which case they register their use of the system in the same database.
Other deployers of high-risk systems do not have to register, but Article 26 gives them documentation duties: use the system in accordance with the instructions for use, assign human oversight to people with the competence and authority to exercise it, keep the automatically generated logs (for at least six months, in so far as the logs are under their control) and inform workers before the system is put into use in the workplace. An organisation that complies ends up with something that looks like a register in practice. But it is documentation per system, not a single list of everything.
Following the Digital Omnibus, those obligations apply from 2 December 2027 for Annex III and from 2 August 2028 for high-risk AI in regulated products (Annex I). The full timetable is set out in the AI Act timeline after the Digital Omnibus. Two things already apply: the transparency obligations of Article 50, since 2 August 2026, and the duty under Article 4 to support AI literacy among staff, since 2 February 2025.
What about the GDPR?
The GDPR has always run separately from all this, and nothing in it has been postponed. If an AI tool processes personal data (summarising a job application, answering a customer email), that is processing, and Article 30 GDPR requires a record of processing activities covering the purpose, the categories of data subjects and personal data, the recipients, the retention period and the security measures. The exemption for organisations with fewer than 250 employees is narrow: it no longer applies once the processing is more than occasional or involves special categories of data, and AI use at work is rarely occasional.
That record is not an AI register. It describes the processing, not the system. For how the two relate and what goes into an AI register, see our guide to the AI register. For how the AI Act and the GDPR work side by side, see our article on what the AI Act means for your business alongside the GDPR.
The Dutch Algorithm Register for public bodies
Dutch public bodies have one more thing to consider: the Algorithm Register at algoritmes.overheid.nl. Central government asks public organisations to publish descriptions of high-impact algorithms and high-risk AI systems there, so that citizens, regulators and journalists can see which algorithms the government uses. Whether and when this becomes a statutory duty is still a matter of political debate; check the site itself for the current position. Companies have no comparable public register.
At a glance:
| Obligation | Who | What | From when |
|---|---|---|---|
| Registration in the EU database (Article 49 AI Act) | Providers of high-risk systems listed in Annex III; public authorities deploying such a system | Register the system, or its use | With the high-risk obligations, 2 December 2027 |
| Deployer duties (Article 26 AI Act) | Any organisation deploying a high-risk system | Use as instructed, human oversight, keep logs, inform workers | 2 December 2027 (Annex III), 2 August 2028 (Annex I) |
| Record of processing (Article 30 GDPR) | Every controller, with a narrow exemption below 250 employees | All processing of personal data, including through AI tools | Already applies |
| Dutch Algorithm Register | Dutch public bodies | Publish descriptions of high-impact algorithms and high-risk AI | At the request of central government |
| Internal AI register | Nobody is obliged to keep one | Which AI tools are in use and what has been decided about them | Voluntary |
So where does that leave the care organisation?
Back to the legal counsel. Two things are going on at her organisation at the same time. HR wants to bring in a tool that pre-sorts job applications. That is an Annex III use, so the Article 26 duties apply from 2 December 2027: human oversight, logs and informing workers. The provider must also have registered the system in the EU database.
Meanwhile, some forty colleagues use a writing assistant for letters to clients. That is not a high-risk system, and the AI Act requires no registration. But personal data goes into it, so the processing belongs in the record of processing, backed by a data processing agreement. And the organisation has no idea which other tools are being used alongside that writing assistant. No law covers that last point, yet it is exactly what the board secretary was asking.
Why organisations keep one anyway
Without a register, you cannot answer the first question every regulator, auditor or board member asks: which AI do you use, and what have you decided about it? The record of processing does not answer that, because it deals with data, not tools. And the AI Act obligations hinge on a classification you can only make once you know which system you are dealing with.
So an internal register is not a legal requirement, but it is a precondition for meeting the requirements that do exist. Its weakness is that it records what people have reported, not what is actually being opened. BeeSensible sets the use it observes in the organisation against its catalogue of over 1,000 assessed AI tools, recording only the domain, at most once per day per device and without a user ID. An administrator sees which tools are still awaiting a decision and records that decision; BeeSensible never makes it itself.
