Why first attempts stall.
A register, not a document.
Three first passes.
A 30-person agency listing its AI tools for the first time.
- Eleven tools found; seven were not on anyone's list.
- Nine land limited or minimal risk — Art. 50 and Art. 4 only.
- Two need a closer look: a client-facing scorer and an HR screener.
- Effort goes to the two, not spread evenly across eleven.
A scale-up that thought it had no EU AI Act exposure.
- The bought recruitment tool puts them in Annex III point 4.
- Deployer duties apply: oversight, logs, the Art. 26(7) worker notice.
- Their own product feature makes them a provider for that one system.
- One register holds both roles without either contaminating the other.
A public body preparing for scrutiny.
- Art. 27 binds: a fundamental-rights assessment is required.
- It pre-fills from the existing DPIA, which Art. 27(4) explicitly permits.
- Affected people informed under Art. 26(11), with the notice dated.
- The classification trail shows how each answer was reached.
What follows the first pass.
Straight answers about starting.
Where does a first assessment actually begin?
With an inventory, not a policy. You cannot classify what you have not listed, and most organisations discover during the listing that they use more AI than they thought — a scoring feature inside a bought HR suite counts as much as a model somebody trained.
How long does it take?
The free check is eight questions for most systems. A first pass over a small estate is an afternoon. What takes longer is the evidence behind the obligations the classification produces, and that is the work the deadlines actually bite on.
What if most of our systems turn out to be low risk?
That is the common outcome and it is a real result, not a wasted exercise. Knowing that eight of your ten systems carry only Article 50 transparency and Article 4 literacy is what lets you spend the effort on the two that carry more.
Do we need to classify systems we are only piloting?
The Act attaches duties to putting a system into service, so a genuine internal pilot sits differently from a live deployment. Recording it now costs little and means the register is already right on the day the pilot becomes production — which is the day people forget to revisit it.
What comes out at the end?
A register of systems, each with a role, a risk class and a derived obligation list citing the articles it rests on — plus a classification record you can reopen and a dated decision trail for how each answer was reached.