AI Act: AI System Register and FRIA

The regulation entered into force on 1 August 2024 and applies in the stages set out in Article 113: first the prohibited practices and AI literacy obligations, then the obligations on general-purpose AI models, and finally the obligations on high-risk systems. The exact deadlines applicable to your organisation depend on the category of your systems; refer to the text published in the Official Journal of the European Union.

A provider develops an AI system or places it on the market under its own name; a deployer uses it under its own authority in a professional context. A company buying an AI solution is in principle a deployer — unless it substantially modifies it or markets it under its own brand, which can transfer the provider obligations to it.

The FRIA (Fundamental Rights Impact Assessment), set out in Article 27, is the assessment certain deployers of high-risk systems must carry out before putting a system into use: description of the uses, categories of persons affected, risks of harm, human oversight measures and redress arrangements.

Because most AI systems used in companies are bought, not built. The information a deployer needs for compliance — system classification, technical documentation, instructions for use, logging — comes from the provider, and must therefore be obtained and retained like any other third-party compliance evidence.

The AI Act module is on our product roadmap. It will build on the same regulatory framework foundation as NIS2, DORA, ISO 27001 and GDPR, with an AI system register, the FRIA and an article-level mapping of obligations.