The audit committee of a pension administrator asks its CIO for a simple overview: every AI system the organisation uses, what it is used for and which risk category it falls into under the EU AI Act. The CIO sends a list of fourteen projects that IT has delivered or is building. Two weeks later, internal audit finds AI in places the list does not mention: a candidate ranking feature in the HR suite, an assistant that drafts replies in the customer service tool and a model in the planning software that allocates work to employees. EU AI Act compliance has stalled on the first question, before anyone has looked at a single obligation.
That gap between the AI you know about and the AI you actually use is common. You cannot classify, govern or document an AI system that nobody has found, and the MetroMinds Library shows why the search is harder than it looks.
Why the EU AI Act starts with knowing where your AI is
Most organisations meet the EU AI Act as a rather than a provider. The Act defines a deployer as an organisation "using an AI system under its authority" [1]. That covers every AI feature your staff use at work, whether you built it, bought it or simply received it as part of a software update.
Your obligations depend on how each system is used. of the Act lists the high-risk areas, and employment is one of them: systems "intended to be used for the recruitment or selection of natural persons", or to "allocate tasks based on individual behaviour or personal traits or characteristics" [1]. Whether a tool is high-risk therefore follows from its purpose, and you can only judge the purpose once you know the tool exists.
The ban on prohibited practices and the duty to support have applied since February 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, moved the start of the Annex III high-risk obligations to "2 December 2027" [2]. That time is best spent on the inventory, because every later step builds on it.
AI arrives inside software you already own
A few years ago, an AI system was usually a project with a business case, a name and an owner. Today, most AI reaches the workplace as a feature inside platforms you already use, often switched on by the vendor in a regular release.
Gartner expects this to accelerate. In August 2025 it predicted that "Forty percent of enterprise applications will be integrated with task-specific AI agents by the end of 2026" [3]. None of those agents will appear on a list of AI projects, because nobody in your organisation started them.
One in fifteen use cases touches a high-risk area
We screened the titles of the 4,980 use cases in the MetroMinds Library against the high-risk areas in Annex III. That is a first indication rather than a legal classification, which always depends on the intended purpose and actual use. Even so, the result is clear: 333 use cases, or about one in fifteen, touch an Annex III area. Employment and workers management is by far the largest group with 151 use cases, followed by critical infrastructure with 91 and public benefits and services with 54. Creditworthiness, education and life and health insurance pricing make up the rest.
The flagged use cases come from more than ten industries. Energy and utilities has the most with 94, followed by professional services with 61 and government with 58. Financial services, education and healthcare follow, so this is far from a topic for banks and public bodies alone.
High-risk AI rarely sits where you expect it
The more surprising finding is where these use cases sit in the organisation. Of the 333 flagged use cases, 122 sit in operations and delivery. Only 56 sit in Human Capital and Culture, the capability HR owns, and 21 in Technology, Data and AI. In total, more than three quarters of them sit outside HR and IT.
Employment is the clearest example. Of the 151 employment-related use cases, only 52 sit in HR's own capability. The others rework crew rosters in rail and logistics, rebalance clinic rosters in healthcare, staff retail stores for a flash sale or rank consultants for client assignments. They change how people are selected, scheduled or assessed, but they are owned by operations managers who may never think of them as HR systems.
You cannot spot high-risk AI by its technology
A natural shortcut is to look for the riskiest technology first. The Library suggests that does not work, because the flagged use cases look technically almost the same as the rest. Their average risk score is 3.87 against 3.82 for the other use cases. Safety and policy enforcement readiness scores 3.51 against 3.58, and 3.77 against 3.82.
The difference lies in what the system is used for and who is affected. A forecasting model that plans grid maintenance and one that plans staff rosters can use the same technique. Only the second one decides who works which shift. That is why an AI inventory has to record purpose, affected people and business owner for every system, rather than only the tool and the vendor.
From a list of tools to an AI register
Many organisations start with a spreadsheet. The trouble starts when it has to stay current while vendors ship new features every quarter.
A register built this way is also the starting point for the deployer obligations that follow, which we describe in our article on what the EU AI Act asks of you once your AI register is ready.
A first inventory in four steps
- Start from all the applications you use rather than from your project list. Include the platforms for HR, customer service, planning, finance and operations, and check which AI features each one offers or has switched on.
- Record the purpose of every AI system in plain words, together with the people it affects and the business owner. The tool name alone tells you very little.
- Screen each purpose against the Annex III areas and mark the entries that need a closer legal classification. Look hardest at systems that select, schedule or assess people.
- Agree how new AI enters the register: through vendor release notes, procurement, new budgets and the portfolio intake. A one-off exercise will be outdated within a quarter.
How MetroMinds supports the AI inventory
MetroMinds runs a portfolio analysis of your applications that identifies where AI is used, including AI features embedded in vendor software. Every finding lands in the MetroMinds AI register, which records what the EU AI Act asks you to know about each system: its purpose, your role as provider or deployer, the risk category and Annex III area, human oversight, logs, owner and status.
Each register entry is linked to the portfolio, so you see which capability it belongs to, which it affects and how it moves from candidate to accepted and approved for execution.
Want to see where AI sits in your own applications? Book a demo
Sources
- European Union, Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 3(4) "deployer" and Annex III "High-risk AI systems referred to in Article 6(2)", point 4, Official Journal, 12 July 2024.
- European Union, Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), amending Article 113 of Regulation (EU) 2024/1689, Official Journal, 2026.
- Gartner, "Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5% in 2025", press release, 26 August 2025.
- MetroMinds Library, 4,980 AI use cases with benchmark ranges based on real-world implementations, August 2026.
