"We don't know which of our systems fall under the EU AI Act"
Lemur Media · author: Dominik Dębski · updated 28.10.2026
Most companies use AI within vendor tools and do not keep a register of these systems. Obligations for high-risk systems listed in Annex III, including in employment and education, apply from 2 December 2027. The first step is a system register and determining the company's role.
What are the symptoms?
- The company has no overview of systems and tools with AI features.
- It is unclear whether the company is a provider or a deployer of a given system.
- The HR or training department uses AI to assess candidates or employees.
- The board asks about the risk of penalties and does not get a clear answer.
What are the causes?
- 01AI features in SaaS toolsVendors add AI features to existing tools without a separate decision by the company.
- 02No owner for the topicResponsibility is split between legal, IT and security.
- 03Changing deadlinesSome obligations already apply; others have been postponed by Regulation 2026/1744.
| Headcount | Typical picture |
|---|---|
| 50–249 employees | Most often concerns HR and customer service tools from vendors; the register can be prepared in a few days. |
| 250–999 employees | The register and classification usually take a few weeks. |
| 1,000+ employees | A permanent process is needed in which every new purchase is assessed for AI. |
What questions should the board ask?
- Which systems are used to assess people: candidates, employees, students or customers?
- Does the company develop its own AI systems, or does it only use third-party ones?
- Who in the company is responsible for compliance with the EU AI Act?
Which metrics should you check?
- Number of systems in the register with an assigned owner
- Share of systems with a defined risk class
- Number of high-risk systems with a compliance plan
Which mistakes should you avoid?
- Putting the work off until 2027: the register and classification require input from many departments.
- Treating the topic solely as a task for the legal department.
How does the solution work?
Methods: LEMUR AI Readiness Index + AI Use Case Portfolio. The Lemur Compass sets the sequence of actions based on the company's development phase, scale, business model and profitability.
- 01System registerAll tools and features with AI, each with an owner.
- 02Company roleProvider or deployer, for each system.
- 03Risk classificationProhibited practices, high risk, transparency, minimal risk.
- 04Compliance planWith a law firm involved where a legal opinion is required.
Where should you start?
A Diagnostic prioritising dimension R (risk and regulation).