An AI agent register for the EU AI Act is an internal record, one row per agent, of the facts your obligations depend on: whether you are provider or deployer, the risk classification and why, the obligations that follow, the evidence each is met, and the owner. It turns the Act into a list you can check.
Does the EU AI Act require this register?
Not under this name. The EU AI Act, Regulation (EU) 2024/1689, sets obligations according to your role and the system's risk tier. It does not prescribe an internal register of all your AI agents. But every obligation starts from the same facts: what the agent is, who supplied it, what it is used for, and how it is classified. Without a register, those facts live in scattered project files. How the obligations connect to controls is set out in AI agent regulation, mapped to controls.
Separately, the Act requires some high-risk systems to be registered in an EU database, depending on the use and on who you are. That is a public registration, not this internal record. Whether it applies to you is covered in whether you need to register AI agents with a regulator.
When should you use it?
When you first assess whether the Act applies to your agents, and then for every new agent and every change in use. A change in what an agent is used for can change its classification. An agent that summarises loan files for staff may be minimal risk; the same agent used to score creditworthiness of individuals falls into a high-risk area listed in Annex III.
Financial entities in the EU keep another register under DORA, of contractual arrangements with ICT third-party providers. Link the two where an agent comes from a third party; see the DORA register of information and AI agent providers.
How do you fill in each field?
- Role is provider, deployer, or both. If you build an agent on a platform and put it into service under your own name, you may be a provider. If you use one as supplied, you are a deployer.
- Use describes the purpose in the terms the Act uses: who is affected and what decision or action the agent takes or supports.
- Risk tier is one of: prohibited, high-risk, transparency obligation, minimal risk. Record the reasoning, including which Annex III area applies if high-risk.
- Obligations lists the articles that apply given role and tier: for a deployer of a high-risk system, Article 26; possibly Article 27; Article 50 where people interact with the agent; Article 4 for every organisation.
- Evidence names the document or record that shows each obligation is met.
- Authority notes the national authority likely to supervise; who enforces the EU AI Act for AI agents explains how this works.
The template
| Field | Guidance |
|---|---|
| Agent and ID | From your inventory |
| Supplier | Internal build, platform, vendor |
| Our role | Provider, deployer, both |
| Intended use | Purpose, affected persons, decision supported |
| Member states of use | Where it is used or its output used |
| Risk tier | Prohibited, high-risk, transparency, minimal |
| Classification reasoning | Including Annex III area if high-risk |
| Obligations | Articles that apply |
| Evidence per obligation | Document or record reference |
| Human oversight assigned to | Named role |
| Logs kept | Where, for how long |
| Fundamental rights impact assessment | Required? Reference |
| Owner | Named person |
| Last reviewed | Date |
A filled example
A hypothetical consumer lender operating in two EU member states.
| Field | Agent 1: Credit pre-assessment | Agent 2: Servicing chat |
|---|---|---|
| Supplier | Platform, configured in-house | Platform, configured in-house |
| Our role | Deployer; provider assessment under review with counsel | Deployer |
| Intended use | Prepares a creditworthiness summary for underwriters on personal loan applications | Answers existing borrowers' questions about their loans |
| Risk tier | High-risk | Transparency obligation |
| Reasoning | Supports creditworthiness assessment of natural persons, an Annex III area | People interact with it directly; it makes no decisions about them |
| Obligations | Article 26; Article 27; Article 4; GDPR Article 22 check | Article 50 disclosure; Article 4 |
| Evidence | Oversight procedure, log retention policy, FRIA ref FR-02, DPIA ref DP-07 | Disclosure wording in chat window; staff training record |
| Human oversight | Senior underwriter | Servicing team lead |
The provider question for Agent 1 is flagged, not guessed. Configuring an agent substantially can shift obligations, and the register is the right place to show that the question is open and with counsel. The wider issues are set out in the EU AI Act and agents that act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Should minimal-risk agents go on the register?
Yes. Recording the classification and its reasoning shows you assessed it. It also makes a later change of use easier to spot.
Who should own the register?
Usually compliance or a central AI governance function, with each agent owner keeping their rows current. Legal should review classification reasoning for any high-risk or borderline entry.
Can this be part of our general AI agent inventory?
Yes, as extra columns. Many firms keep one inventory with EU AI Act fields added, which avoids two lists drifting apart.