Scopecanon
Sign inCheck your estate

EU AI Act · deployer obligations

Some of your AI arrived in an update, not in a purchase order.

Somebody signed off on some of your AI. Other parts shipped inside tools you already had — a model in a point release, scoring switched on by default, an API wired to a spreadsheet one Thursday. Start by recording what you use and how. High-risk deployer duties depend on that use, the applicable date and any transition rules.

Check your estate freePaste the supplier list you already have. No account, no card, no call.
EU AI Act · in scopeApplicant rankingAnnex III(4)Credit scoringAnnex III(5)Support chatbotArt. 50

Paste a supplier list. Watch it match.

This is the product's own matcher and catalogue, running live — not a recording. Type the tools your company pays for, or their domains, and see which ship an AI feature, the classification each suggests and the clause it rests on.

229
AI-bearing products and APIs in the catalogue, in 22 families
Every match
carries its clause and the vendor's own source page
Nothing
you type in the check is stored
0 / 60
Matches appear here as you type — the product, the AI feature it ships, the classification it suggests and the clause.

Most of it arrived without a purchase order

Compliance teams are told to inventory their AI. They ask around, write down the systems somebody remembers, and miss the ones that came bundled. We start from the lists you already keep — the supplier spreadsheet, the applications exported from your identity provider, the tools on your expenses, plus domains — and match them against a catalogue of more than 200 AI-bearing products and APIs: what the AI feature does, a proposed classification with its clause, and the vendor's own page as the source. You get a register you did not have, with a reason attached to every line.

AI estate
inventory and review now
2 Dec 2027
Annex III high-risk application date
2 Aug 2028
Annex I high-risk application date

A risk tier with no reason attached is just an opinion

Every system here carries the Annex III area it falls in, the clause that puts it there, and a sentence explaining why — in language your counsel can argue with. When they disagree, they disagree with a specific line and you change it. That is a fifteen-minute conversation instead of a project.

Worked exampleInvented company, real rules

A logistics firm in Madrid uses its HR platform to rank job applicants. Nobody bought an AI system; the feature arrived in an update.

Role: DeployerRisk tier: High riskAnnex III: Point 4 — employment

7 items to review and prepare. The high-risk items have future application dates; the AI-literacy support duty is already applicable.

  1. AI-literacy support measuresAI Act Art. 4
  2. Human oversightAI Act Art. 26(2)
  3. Input data relevanceAI Act Art. 26(4)
  4. Monitoring and incidentsAI Act Art. 26(5)
  5. Log retentionAI Act Art. 26(6)
  6. Telling the people affectedAI Act Art. 26(11)
  7. Worker notificationAI Act Art. 26(7)

Change the use and the list changes. Mark the same tool as drafting job adverts rather than ranking people and most of these disappear — which is the point: the duty follows what you do with it, not what you bought.

Eight areas decide almost everything

These are the eight Annex III areas. A use within one may require high-risk review; the exact use and statutory exceptions matter. The example above shows preparation items, not a determination that every duty already applies to you.

  • Employment

    Screening applicants, allocating work, evaluating people

  • Essential services

    Creditworthiness, insurance pricing, access to benefits

  • Education

    Admission, assessment, monitoring during exams

  • Biometrics

    Remote identification, categorisation, emotion inference

  • Critical infrastructure

    Safety components in water, gas, heating, electricity, traffic

  • Law enforcement

    Risk assessment, evidence evaluation, profiling

  • Migration and borders

    Visa and asylum examination, risk assessment at a border

  • Justice and democracy

    Assisting a judicial authority, influencing an election

The pack, not the percentage

Oversight assigned to a named person, not a mailbox. Input data relevance. Logs kept six months — the duty most companies discover after the logs have already rotated. Workers informed BEFORE go-live, which is the one obligation that cannot be fixed retrospectively. Each is derived from the classification rather than ticked off a list, so the inconvenient one cannot quietly go missing.

The machine proposes. A person decides.

Everything we find arrives marked proposed and stays visibly so until somebody at your organisation accepts or rejects it. The register records which of the two happened, when, and by whom — because that is the first thing an auditor asks, and a tool that cannot answer it is a spreadsheet with better typography.

This tool will never tell you that you comply

Whether you meet an obligation is a legal conclusion about a specific deployment in a specific member state, and no scanner reaches it. There is no status called compliant here — not in the reports, not in the interface, not in the database. What we can show is which duties are engaged and which evidence exists, and that is checkable. Anything more would be a number you could not defend.

Check your estate free

Paste the supplier list you already have. No account, no card, no call.