CIO
Why EU AI Act Compliance Starts With Finding Your AI
You cannot classify or govern AI you have not found. One in fifteen Library use cases touches a high-risk area, and most of them sit outside HR and IT.
EU AI Act check
Which EU AI Act rules may apply to your AI?
Answer a few questions about where you use AI. You see which high-risk areas of the EU AI Act may apply, what that means for you, and from which date.
This check gives an indication. It is not legal advice.
- Prohibited practices and AI literacy
- General-purpose AI
- High-risk systems in Annex III
- High-risk systems in Annex I
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
High-risk AI is not limited to regulated sectors
A first screen of the MetroMinds Library shows that about 1 in 15 use cases touch an area listed in Annex III. They come from more than ten industries, and most of them sit in operations rather than in HR or IT. Whether a system is high-risk depends on its purpose, not on the technology behind it.
Where the flagged use cases come from
- 94
- Energy and utilities
- 61
- Professional services
- 58
- Government
Financial services, education and healthcare follow, so this is far from a topic for banks and public bodies alone.
Why EU AI Act compliance starts with finding your AI
From a first check to an AI register you can show a supervisor
MetroMinds runs a portfolio analysis of your applications to find where AI is used, including AI features inside vendor software. Every system lands in an AI register that records what the EU AI Act asks you to know: purpose, your role as provider or deployer, risk category, human oversight, logs and owner.
GovernanceAI registerDemo environmentAI register
Four AI systems, four classifications
| AI system | Purpose | Role | Risk category | Annex III area | Owner | Status |
|---|---|---|---|---|---|---|
| Candidate ranking in recruitment platform TalentFlow Recruit | Rank applicants for open vacancies | Deployer | High risk | Employment | HR director | Approved |
| Credit decline reason codes LoanDesk Origination | Explain credit declines to applicants | Deployer | High risk | Creditworthiness | Head of Credit Risk | In review |
| Customer service chat assistant ServiceHub | Answer customer questions in the app chat | Deployer | Limited risk | — | Head of Customer Service | Approved |
| Invoice extraction in ERP Kestrel Ledger ERP | Read supplier invoices into the ledger | Deployer | Minimal risk | — | Finance Operations Manager | Approved |
Read next
Risk and compliance
What the EU AI Act Asks of You Once Your AI Register Is Ready
An AI register shows what you have. The EU AI Act deployer obligations are about how you run it: oversight, logs, monitoring, impact assessments and informing people.
CHRO
Who Is Accountable When AI Prepares the Decision and a Person Signs It?
In 96 percent of AI use cases the AI prepares and a person decides. That makes the human in the loop a role that HR has to design, staff and support.