{"id":5118,"date":"2026-09-01T09:00:00","date_gmt":"2026-09-01T07:00:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=5118"},"modified":"2026-10-20T18:48:52","modified_gmt":"2026-10-20T16:48:52","slug":"what-should-an-ai-use-register-contain","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/what-should-an-ai-use-register-contain\/","title":{"rendered":"What should an AI use register contain?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for DPOs and compliance teams \u2022 published September 1, 2026 \u2022 updated October 20, 2026 \u2022 8 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

The AI Act does not require an internal register of AI use cases. Registration in the EU database under Article 49 is a separate duty that concerns selected systems listed in Annex III. What the AI Act does impose are three obligations for which a central inventory is a practical and evidentially strong tool. Those are the AI literacy duty in Article 4, the ban on prohibited practices in Article 5 and the transparency obligations in Article 50. Without such an inventory, demonstrating compliance is materially harder and riskier. The scope of the register therefore follows from those obligations rather than from a ready-made template. For each use case record the process and the intended purpose, the risk classification and the role of the organisation with the reasoning, and the provider. Add the answers to the Article 50 questions, the people using the tool and the measures supporting their AI literacy. Complete the entry with the link to the GDPR documentation, changes to the system and its intended purpose, and the person responsible for keeping the entry current. For high-risk AI systems add the date of placing on the market or putting into service. Add also the person exercising human oversight, the retention of logs and the information for workers. The obligations in Articles 25 and 26 will start to apply on 2 December 2027 to high-risk AI systems under Annex III and on 2 August 2028 to high-risk AI systems under Annex I.<\/p>\n<\/div>\n\n\n\n

Why the question comes up at all<\/h2>\n\n\n\n

The record of processing activities has its basis in Article 30 GDPR. For artificial intelligence there is no provision on an internal list of use cases. The question about a register therefore looks like a question about good practice. It looks that way until the first time a client or an auditor asks where AI is at work in the organisation.<\/p>\n\n\n\n

The second reason is organisational. Artificial intelligence entered the organisation by several routes at once. Some tools were bought deliberately. Some appeared as a new feature in software used for years, and some were built by teams on general-purpose models. None of those routes ends with an entry in any list.<\/p>\n\n\n\n

The third reason concerns evidence. The Regulation does not provide for an internal list of use cases. It does speak of informing, of oversight and of assessment. Each of those activities requires knowing what it applies to. Article 49 provides for registration in the EU database of selected systems listed in Annex III. That registration falls on providers or, where applicable, their authorised representatives. It also falls on public authorities and Union institutions, bodies, offices or agencies that deploy such high-risk AI systems. The same applies to persons acting on their behalf. An entry in that database does not replace an internal list of use cases.<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

An organisation that does not know where it has AI will not perform any AI Act obligation in a way that can be checked.<\/p>\n\n<\/div>\n\n\n\n

What to establish before deciding<\/h2>\n\n\n\n

Three obligations that already bind<\/h3>\n\n\n\n

The register should primarily make it possible to perform the obligations that apply today.<\/p>\n\n\n\n

AI literacy, Article 4, since 2 February 2025.<\/strong> Since 27 July 2026 the provision has had the wording given to it by Regulation (EU) 2026\/1744. Providers and deployers take measures supporting the development of AI literacy among their staff and other persons dealing with the operation and use of the systems on their behalf. The provision states expressly that the duty does not mean guaranteeing a particular level of AI literacy in individual people. It is therefore a duty of care rather than of result.<\/p>\n\n\n\n

Performing it requires knowing who uses which tool and in what role. Without that knowledge, training reaches either everyone or nobody.<\/p>\n\n\n\n

Prohibited practices, Article 5, since 2 February 2025.<\/strong> The prohibition does not depend on the risk classification. It concerns what the system does and how the organisation uses it. The register should therefore describe the intended purpose and the manner of use precisely enough to be set against the list of prohibitions. Two new prohibitions take effect on 2 December 2026. For those two the conditions of infringement depend on the role (Article 5(1a)). A deployer infringes them only where it uses the system for the purpose of generating the prohibited material or manipulating it.<\/p>\n\n\n\n

Transparency, Article 50, since 2 August 2026.<\/strong> The obligations divide according to role. The provider ensures that a system intended to interact directly with people is designed and developed so that they are informed that they are interacting with an AI system. Among other exceptions, the duty does not apply where this is obvious to a reasonably well-informed, observant and circumspect person. Obviousness is assessed taking into account the circumstances and the context of use. The provider is also responsible for marking synthetic content in a machine-readable format. A provider whose system generating synthetic content was placed on the market before 2 August 2026 has until 2 December 2026 to do so (Article 111(4)). The deployer informs people about emotion recognition and biometric categorisation. It also discloses deep fakes and text published with the purpose of informing the public on matters of public interest. The duty concerning text does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication.<\/p>\n\n\n\n

In the register this comes down to three questions for each use case. Does the system talk to people? Does it generate content? Does it recognise emotions or categorise people on the basis of biometric data?<\/p>\n\n\n\n

What to add now, so the register is not built twice<\/h3>\n\n\n\n

The obligations in Articles 25 and 26 concern high-risk AI systems. They sit in Chapter III Section 3. They start to apply on 2 December 2027 to high-risk AI systems under Annex III and on 2 August 2028 to high-risk AI systems under Annex I. They do not bind yet.<\/p>\n\n\n\n

That is not a reason to leave them out of the register. The fields they will call for are already known. Filling them in after the fact costs more than entering them straight away.<\/p>\n\n\n\n

The date of placing the system on the market or putting it into service settles whether and from when the obligations in Articles 25 and 26 will cover a high-risk AI system. For operators of a high-risk AI system placed on the market or put into service before the date of application of Chapter III, the Regulation applies only after a significant change in its design (Article 111(2)). This is without prejudice to the application of the prohibitions in Article 5. In any case, providers and deployers of high-risk AI systems intended to be used by public authorities must take the necessary steps to comply with the Regulation by 2 August 2030. According to recital 39 of Regulation (EU) 2026\/1744, what decides whether the transitional period in Article 111(2) applies is the date on which the first unit of that type and model was placed on the market or put into service. The date on which the organisation bought the system is therefore not decisive.<\/p>\n\n\n\n

Article 25 calls for knowledge of three things. It has to be known whose name the high-risk AI system runs under, whether it has undergone a substantial modification and whether a change of intended purpose has turned the system into a high-risk AI system. These answers have to be known at the moment of the change, not a year later.<\/p>\n\n\n\n

For deployers of high-risk AI systems Article 26 adds elements worth knowing before 2 December 2027 (Annex III) or 2 August 2028 (Annex I).<\/p>\n\n\n\n