EU AI Act
AI Act deployer inventory for SMBs
If you use AI systems on customer or employee data, you may be a deployer under the EU AI Act. Here is a minimal inventory SMBs can maintain without enterprise GRC.
Published 2026-09-02
The EU AI Act distinguishes providers (who place systems on the market) from deployers (who use them under their authority). Most SMBs are deployers for copilots, transcription, and LLM APIs embedded in workflows.
What to record per system
- System name and purpose in plain language.
- Role: provider, deployer, or both.
- Risk tier (minimal, limited, high — confirm classification with counsel).
- Data categories and region.
- Deployer checklist: oversight, logging, staff literacy, incidents.
- DPA / no-train terms like any other processor.
PrivyLedger’s AI register adds these fields to AI-category vendors and exports an AI Act inventory markdown table alongside the existing AI evidence pack.
Operational guidance only — not legal classification advice.
Questions
Do all SMBs need an AI Act inventory?
Not every tool is high-risk, but you still need to know which AI systems you use, your role (provider vs deployer), and what data they process — customers and auditors already ask.
What are deployer obligations?
Article 26 expects appropriate human oversight, logging where relevant, staff literacy, and incident reporting for high-risk systems you operate. PrivyLedger tracks these as checklist flags per AI vendor.