The documents an auditor asks for, written before they ask

A structured register for every AI system your organisation runs.

• System register template with owner, purpose, data categories and deployment status
• Classification columns aligned to the EU AI Act risk tiers
• Vendor and third-party dependency fields
• Fill-in guidance per column

Hand to: your CTO or Head of Engineering as the starting register, and to an auditor as evidence that a register exists and is maintained.

Not a discovery tool. It does not find your systems for you — it gives you somewhere to put them once you have looked.

Which EU AI Act obligations attach to which role, system by system.

• Provider / deployer / importer / distributor obligation matrix
• Article-by-article mapping with the obligation in plain language
• Scope-determination worksheet per system
• Worked examples of role conflicts (you can be provider for one system, deployer for another)

Hand to: your compliance lead as a working map, and to a client or auditor as the reasoning behind your scope decisions.

Not a legal opinion. It maps obligations to roles — it does not tell you your organisation has been classified correctly, and it is not advice on your facts.

A register built for AI risk, not retrofitted from a generic risk template.

• Risk register with likelihood, impact and residual scoring
• EU AI Act article references per risk entry
• Treatment plan and owner fields with review cadence
• Board-summary view for reporting upward

Hand to: your risk function as the operating register, and to your board or an auditor as the artefact that shows AI risk is being governed rather than noted.

Not a quantification model. It scores and tracks risk — it does not compute financial exposure, and it is not a substitute for your own risk appetite framework.