Turn on the EU AI Act register

This guide enables the eu_ai_act_register regulatory toggle, which surfaces the AI Systems register under CMDB. The register lets a compliance officer inventory each AI system the organisation deploys or operates, with the Level-1 and Act-specific fields the EU AI Act (Reg. 2024/1689) expects. See the toggle catalog for the flag and the role catalog for who can read and write the register.

Before you start. An AISystem is a CMDB configuration item — a subtype of Application. Registering one reuses the same supplier and contract links as the rest of your CMDB (supplied_by -> Supplier, governed_by_contract -> Contract), so a system sourced from a third party stays connected to its DORA register entry.

Prerequisites

• A role that grants settings.featureflags.toggle to turn the flag on -- the platform owner and tenant administrator have it (see the role catalog).
• MFA satisfied for your session.
• To use the register once it is on: ai_governance.ai_system.read to view it and ai_governance.ai_system.create / .update to maintain it. The compliance officer holds all three; the CMDB manager and administrator can read and write; an auditor has read-only access.
• To classify an AI system's risk (AIG-02): ai_governance.ai_assessment.create to draft a classification and ai_governance.ai_assessment.accept to accept it. The compliance officer holds both; the CMDB administrator can draft (create) only; an auditor reads classifications via ai_governance.ai_system.read.

Steps

1. Go to Settings -> Regulatory features.
2. Find EU AI Act register in the EU-AI-Act group and switch it on. The change is audited.
3. Open CMDB -> AI Systems (the tab and the g then a navigation shortcut appear once the flag is on).
4. Choose Register AI system, give it a name and a purpose, and fill in the Act fields (role in the value chain, technology type, human-oversight mode, data categories). The compliance fields carry an information tooltip sourced from the regulatory mapping catalog.

Classify an AI system's risk (AIG-02)

Once a system is registered, classify it under the EU AI Act risk tiers (Art. 5 prohibited, Art. 6 + Annex III high-risk, Art. 50/51 transparency, otherwise minimal):

1. Open the system's detail page (/cmdb/cis/<id>) and find the Risk classification panel.
2. Choose Classify this AI system. Answer the Level-2 questionnaire — each item carries its EU AI Act article reference as an information tooltip. The system suggests a tier from your answers; it never asserts one.
3. Confirm the AI Act role, edit the rationale, and choose Accept classification. The accepted classification is effective-dated and supersedes the previous one (kept in history).
4. If the system later changes materially (role, system type, or data categories), the classification is automatically flagged Re-review required; re-run the questionnaire and accept again. A reviewer can also Re-open for review manually.

A CMDB administrator can Save draft but cannot accept — acceptance is the compliance officer's gate.

Record a fundamental rights impact assessment (AIG-03)

The EU AI Act requires a Fundamental Rights Impact Assessment (FRIA) under Art. 27 — but only for a narrow set of high-risk deployments. The FRIA panel on an AI system's detail page tells you whether one is required and lets you record it:

1. Open the system's detail page (/cmdb/cis/<id>) and find the FRIA panel, below Risk classification.
2. Choose Start FRIA. Record the Art. 27(1) triggers — whether your organisation deploys the system as a public-service body, and whether the use case is creditworthiness/credit scoring (Annex III 5(b)) or life-and-health-insurance pricing (Annex III 5(c)). Each trigger carries its article reference as a tooltip.
3. The panel shows Required (Art. 27) or Not required live: a FRIA is required only for a high-risk deployer with at least one of those triggers. A system that is not high-risk, or where no trigger applies, shows Not required.
4. Fill the Art. 27(1) assessment — the deployer processes, the period and frequency of use, the categories of people affected, the specific risks of harm, the human-oversight measures, and what you will do if those risks materialise. If a GDPR data protection impact assessment already covers the system, reference it in DPIA reference rather than duplicating it (Art. 27(4)).
5. Choose Complete FRIA. The completed FRIA is effective-dated, bound to the AI system, and supersedes any previous one (kept in history). If the deployment later changes, Re-open for review flags it for an update (Art. 27(2)).

The FRIA reuses the same permissions as the risk classification: a CMDB administrator can Save draft, but completing it is the compliance officer's gate (ai_governance.ai_assessment.accept).

What this commits you to

• The AI Systems register, its CMDB tab, and the navigation shortcut are hidden while the flag is off; turning it on reveals them for the whole tenant.
• Registered systems are ordinary CMDB CIs (natural ID AIS-NNNN), versioned and audited like any other CI, and reachable at the same sharable URL whoever opens it.
• The toggle defaults off. Registering a system, and accepting a risk classification, do not by themselves lock the toggle on — they are internal governance records, not exported regulated artifacts. Stickiness triggers later, when a KI-Register export is generated (AIG-06): the toggle becomes sticky and can only be switched off through a dual-approval request. Read why toggles are sticky if that is new to you.

Verify

• AI Systems appears under CMDB, and Register AI system opens the create form.
• A newly registered system appears in the list with an AIS- identifier and opens its detail view at /cmdb/cis/<id>.
• The audit log shows one entry for the toggle change and one for each system registered.

Optional: link the models and data a system uses

On an AI system's detail page, an AI assets panel lets you record the optional model-level depth — the model the system uses and the datasets or prompts it processes. This is opt-in: a pure-deployer tenant that only consumes a vendor API can skip it entirely.

• Link a model by typing its name (for example GPT-4o). The platform creates an AIModel configuration item (identifier AIM-NNNN) the first time, and reuses the same record when another AI system uses the same model — so "GPT-4o" is one entry across your estate.
• Link a dataset or prompt by name and choose its role (training data, evaluation data, fine-tuning data, prompt, reference data, or output data). These are recorded as ordinary Data Asset CIs.
• Remove a link to close it; the model or data-asset CI stays in the CMDB — only the link is removed, and the change is audited.

Linking requires ai_governance.ai_system.update (the compliance officer and the CMDB manager hold it); viewing requires ai_governance.ai_system.read. The panel and the model/dataset relationships are hidden while the register flag is off. The m keyboard shortcut on an AI system's page jumps to the link field.