If you use multiple AI tools at the same time, you can ensure compliance with the AI Act by maintaining a central AI inventory, determining the risk level for each tool, and clearly documenting who is internally responsible for which system. The EU AI Act imposes obligations on both providers and deployers, and it is precisely the combination of multiple tools that makes it difficult to maintain an overview. In this article, we answer the most frequently asked questions about AI compliance in a diverse AI tool landscape.
Which AI tools are covered by the AI Act?
The AI Act applies to any AI system that you develop, use, import, or distribute within the EU, regardless of whether it is your own tool or a service provided by a third-party provider. This includes chatbots, decision-support systems, image recognition software, automation platforms, and large language models. If the output of an AI system is used within the EU, the regulation applies even if the system itself was created outside the EU.
The law distinguishes between four risk levels. Most AI tools that organizations use on a daily basis fall into the “minimal” or “limited” risk categories and are therefore largely unregulated or subject to only light transparency requirements. High-risk AI, such as systems used in human resources management, credit assessment, or access to essential services, is subject to strict regulations. Systems that are completely prohibited include those that use subliminal manipulation, perform social scoring, or employ emotion recognition in the workplace.
In addition, the law introduces a separate regime for General Purpose AI (GPAI) models, such as large language models. Providers of these models have their own documentation and transparency obligations, regardless of the risk category of the specific application.
How do you know which requirements apply to each AI tool?
The obligations that apply depend on two factors: the tool’s risk category and your role in the chain. If you are a deployer—that is, an organization that uses an AI system from an external provider—different obligations apply than if you are the provider who develops and markets the system yourself.
As a deployer, you are required to:
- to use the system in accordance with the provider’s user manual
- assign human supervision to qualified and trained employees
- to retain logs for at least six months
- inform employees before a high-risk system is put into service (Article 26(7))
- to conduct a data protection impact assessment (DPIA) where applicable
For each tool in your portfolio, it is therefore essential to determine whether it constitutes a high-risk system under Annex III of the Regulation. Systems that profile natural persons are always high-risk, regardless of their intended use. Systems that perform only a preparatory or procedural task without posing a significant risk to fundamental rights may fall outside the high-risk category, provided you document this with supporting evidence.
What is the biggest risk when combining multiple AI tools?
The biggest risk when combining multiple AI tools is losing track of who is responsible for what. When different tools from different providers work together in a single process, a responsibility gap can arise: as the deployer, you may assume that the provider covers certain risks, while the provider assumes that you, as the user, will take additional measures.
A second risk is the cumulative impact. An individual tool may pose a low risk, but when multiple systems collectively influence a decision—for example, in a customer contact process where an AI chatbot, a routing system, and a decision model work together—the combined effect may indeed exhibit high-risk characteristics. The AI Act assesses systems based on their actual use and impact, not just their technical design.
In addition, anyone who adds their name to a system, makes a substantial change to it, or alters its intended purpose in such a way that the system becomes high-risk, becomes a provider themselves, with all the associated obligations. This is a point that is often overlooked when combining or modifying tools.
How do you create an AI inventory for compliance purposes?
An AI inventory is a structured overview of all AI systems used by your organization, including their risk category, provider, intended use, and the person responsible for them within the organization. Compiling such an inventory is the practical foundation of any AI compliance approach.
Follow these steps to create a practical inventory:
- Identify all AI tools, including those used indirectly through SaaS platforms or built-in features in existing software.
- Determine the risk category for each tool based on its intended use and the Annex III criteria of the AI Act.
- Define your organization’s role: Are you a deployer, a provider, or both?
- Document the provider’s user manual and the internal agreements regarding human oversight.
- Record the logging requirements for each tool and ensure that logs are retained for at least six months for high-risk systems.
- Assign each tool to a specific person within your organization.
Keep the inventory up to date. AI tools are updated regularly, and an update may change the risk category or the applicable obligations. Therefore, do not treat the inventory as a one-time document, but as a living record.
Who is responsible for AI Act compliance within an organization?
Compliance with the AI Act is not the responsibility of a single person or department. In practice, at least three roles are involved: the operational owner of the tool, the IT or digital transformation manager, and the privacy or compliance officer. For high-risk systems, senior management is also responsible, because the regulation requires that human oversight be entrusted to competent and trained individuals.
The Privacy Officer plays a key role in conducting data protection impact assessments (DPIAs), which are required when a high-risk AI system processes personal data. The HR department is involved in the obligation to inform employees before high-risk systems are put into use.
A practical consideration: The AI Act stipulates that individuals who are subject to a decision made by a high-risk system may, pursuant to Article 86, request an explanation of the determining factors. Your organization must be able to provide that explanation. This requires not only technical knowledge of the system, but also clear internal processes and a designated point of contact.
How do you stay compliant when AI tools are updated regularly?
Maintaining compliance amid regular updates requires a fixed review process that is triggered as soon as an AI tool undergoes a significant change. An update can alter a system’s intended use, underlying data, or output, which can have direct implications for the risk category and applicable obligations.
Determine internally what a “substantial modification” means for your tool ecosystem. The AI Act stipulates that anyone who makes a substantial modification to a system becomes a provider themselves. That’s a line you’ll want to monitor carefully, especially if you’re customizing or integrating AI tools into your own processes.
Practical steps to stay up to date:
- Proactively ask providers for changelogs and release notes with every update.
- With each significant update, reassess the risk category in your AI inventory.
- Check whether the supplier’s user manual has been updated and update your internal work instructions accordingly.
- Ensure that employees who work with high-risk systems are informed of any relevant changes.
- Schedule a full review of your AI inventory at least once a year, and more frequently if the tool landscape is changing rapidly.
The phased implementation of the AI Act will continue through 2027, with reviews in 2028 and 2029. High-risk Annex III systems will be subject to full compliance requirements as of August 2, 2026. This gives organizations the flexibility to build their compliance process step by step, but makes a structured approach all the more important now.
How Pegamento Helps with AI Compliance
Tracking AI compliance across multiple tools is exactly the kind of challenge where a fragmented vendor landscape can cause problems. We help organizations gain control of their AI environment—from assessment to implementation—all under one roof, without the need for complex coordination among multiple parties.
What we offer in the areas of AI compliance and responsible AI use:
- Overview and Assessment: We help you identify which AI systems you use and the obligations associated with them.
- Responsible AI Implementation: Our Agentic AI solutions for customer service are designed with human oversight as a core principle, not as an afterthought. Agentic AI thus represents an evolution from task-oriented bots to self-thinking assistants that take the initiative independently, but always within clear guidelines.
- No costly custom development, but a smart combination of proven modules: you get a tailored solution that fits your organization and compliance requirements, without the costs and risks of fully custom-built systems.
- A single point of contact: from consultation to implementation and management, so you always know who is responsible.
- ISO 27001, ISO 9001, and ISO 26000 certified: information security and quality are embedded in our work processes.
Would you like to know where your organization stands right now in terms of AI compliance? Contact us, and we’d be happy to help you figure it out.
Frequently Asked Questions
What are the fines for non-compliance with the AI Act?
The AI Act establishes a tiered system of fines based on the severity of the violation. Fines for using prohibited AI systems can reach up to 35 million euros or 7% of global annual revenue. Violations of obligations regarding high-risk systems are subject to fines of up to 15 million euros or 3% of revenue, and providing inaccurate information to regulators can result in fines of up to 7.5 million euros or 1% of revenue. Precisely because the fines are substantial, it pays to invest in a solid compliance structure now.
Do I need to actively inform my employees that they are working with an AI system?
Yes, for high-risk AI systems, Article 26(7) of the AI Act requires deployers to inform employees before the system is put into use. This also applies when an existing system is significantly modified. In practice, this means you must establish an internal communication process—preferably linked to your AI inventory—so that every relevant employee is informed in a timely and verifiable manner.
How do I handle AI functionality that is already built into software I use, such as a CRM or HR platform?
Built-in AI features in SaaS platforms are also subject to the AI Act if you actively use them within the EU. Check with your software vendor to find out which AI functionality is active, what its intended use is, and whether the system is classified as high-risk. Include these systems in your AI inventory, even if you did not intentionally purchase them as ‘AI tools,’ because as a deployer, you are responsible for their use.
When is my organization considered a 'provider' rather than a 'deployer'?
Your organization becomes a provider as soon as you market an AI system under your own name, substantially modify an existing system, or alter the intended use in such a way that the system falls into a higher risk category. This is a common pitfall when integrating or fine-tuning existing AI models into your own processes. As a provider, you are subject to significantly stricter obligations, including conformity assessments, technical documentation, and registration in the EU database.
How do I combine AI Act compliance with existing GDPR and DPIA obligations?
The AI Act and the GDPR overlap when it comes to data processing: when a high-risk AI system processes personal data, you are required under both regulations to conduct a DPIA. In practice, you can combine these processes by expanding your existing DPIA template to include AI-specific questions about risk category, human oversight, and logging requirements. Involve your Privacy Officer early in the AI inventory process to avoid duplication of effort and achieve an integrated compliance approach.
Are there any tools or templates available to help set up an AI inventory more quickly?
The European Commission and national data protection authorities, including the Dutch Data Protection Authority, publish guidelines and working documents that you can use as a basis. In addition, frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 offer structured methods for AI governance that align well with the AI Act requirements. To get started practically, you can also collaborate with a specialized partner that has already developed a working inventory methodology, so you don’t have to start from scratch.
What should I do if an AI provider discontinues a tool or changes its services?
If a provider discontinues or significantly changes its service, this has direct consequences for your compliance status: the user manual you, as the deployer, are permitted to rely on becomes invalid, and you must reassess whether and how you can still use the system responsibly. Always include provisions in contracts with AI providers regarding notification of changes, transfer of documentation, and continuity guarantees. Also, make sure your AI inventory includes a column for contract expiration dates and scheduled review dates, so you don’t run into any surprises.
