What it is: A complete list of every AI tool your company uses — from CV screening software to ChatGPT.

Why you need it: The EU AI Act requires every organisation to know exactly which AI systems they use and what they do. Without a register, you cannot prove compliance.

What it means: The EU AI Act divides all AI systems into risk levels. The higher the risk, the more you must do to comply.

The 4 risk levels:
🔴 High Risk — AI used in HR, recruitment, performance, credit, education → strict rules apply
🟡 Limited Risk — Chatbots, content generators → transparency notices required
🟢 Minimal Risk — Spam filters, scheduling → no specific obligations
⛔ Prohibited — Social scoring, real-time biometric surveillance → completely banned

What it is: A Gap Analysis compares where you are today with where the law requires you to be. Each item on the checklist is a legal obligation.

Why it matters: This is usually the first thing a regulator or auditor will ask for — evidence that you systematically reviewed your compliance status.

What it is: A Bias Check analyses whether your AI system treats different groups of people unfairly — for example, whether it selects fewer women than men for job interviews.

Why the law requires it: Articles 9 and 10 of the EU AI Act require that High-Risk AI systems are regularly tested for discriminatory outcomes. You must be able to show the results to regulators.

What it means: For every High-Risk AI system, a qualified human must be able to review, override, and if necessary switch off the AI. The law requires this to be formally documented.

In practice: Your HR manager who can override the CV screening result is your "Human Oversight Person." You need to write down who this is and what their authority covers.

What it means: When you buy or use an AI system from a vendor, you share compliance responsibility with them. You need to document that you asked your vendor the right questions.

In practice: You send a compliance enquiry to your AI vendor (e.g. HireVue, Workday) asking them to confirm their EU AI Act compliance status. Their written response becomes part of your audit evidence.

What the law says: Article 4 of the EU AI Act requires that all employees who work with AI systems have "sufficient AI literacy" — meaning they understand what AI can and cannot do, and what the risks are.

What counts as "sufficient": There is no fixed standard, but completed AI literacy training from a recognised provider — like IADM's CPD-accredited programme — creates a strong, documentable record.

What it means: Every person who is affected by a High-Risk AI decision must be told — in clear language — that AI was used. For HR systems, this means:
• Job applicants must be told their CV was screened by AI
• Employees must be told their performance is monitored by AI

When to inform them: Before or at the time the AI makes a decision — not afterwards.

What "Deployer" means: You are a Deployer — a company that uses AI systems built by others (like Workday, HireVue, or OpenAI) in your own business context. This is different from the AI developer.

Why this matters: The EU AI Act gives Deployers their own set of obligations. You cannot simply say "the AI vendor is responsible." You have direct legal duties under Art. 26.

What it is: A structured collection of all the documents that prove your company complies with the EU AI Act. Think of it as your compliance passport.

When you need it: If a regulator, client, or auditor asks "can you prove you comply with the EU AI Act?" — you open this folder and show them.