Register your first AI system
Add an AI system, answer the guided questions — prohibited practices, models, product law, risk, your role, personal data, what it does — and get a classification with the exact obligations that apply.
Everything in Veritome hangs off an AI system. Before the EU AI Act applies to anything, you have to know what you have — so your first job is to build an inventory. Registration is the front door of the six-stage EU AI Act journey (Classify → Scope & literacy → Build & document → Conformity assessment → Register → Operate & monitor): it captures what the system is and who you are in the value chain, and hands those answers to the engine that decides what you must do.
Step by step
- Open AI systems and press Register AI system (the Dashboard header has the same button).
- The guided flow asks what the system is, then its questions one at a time, then shows a review. Nothing is created until you confirm on the last screen, and your draft is kept in this browser, so you can close it and return without losing your answers.
- What is the system, and what does it do? — a recognisable name (CV-screening assistant) and a few lines on what it does, who uses it and what it decides or supports. This is the text the engine and Aria read back at the end, so make it descriptive.
- The questions — prohibited practices, general-purpose models, product law, the Annex III area and the Art. 6(3) exception, your role, personal data, what the system does and whether it is already on the market. Follow-ups appear only where an earlier answer makes them matter. See Classify a system: the guided flow, screen by screen for each.
- Review — the tier, the obligations the engine will generate and, folded under Why this tier, Aria's reading of your answers. Tick the declaration and press Create system (or Edit answers to go back). The system lands on the register, its obligations are generated, and its dossier opens with a sealed first entry.
Vendor, department, version and the system owner are set on the record afterwards; owners can also be set per obligation. To bring an inventory you already keep, Import CSV loads many systems at once, each classified from its record.
Register a system even if you are not sure it is in scope. Running it through classification is the cleanest way to find out — and a system you have assessed and excluded is a far better answer to a regulator than one you never looked at.
The questions that switch obligations on and off
A handful of yes/no answers change which obligations apply. The engine reads them as flags on the system, so answer them honestly.
| Question | Basis | What it drives |
|---|---|---|
| Does it do anything on the prohibited list? | Art. 5 | Yes makes the system Prohibited; Not sure is treated as not prohibited and flagged for review. |
| Is a general-purpose AI model involved? | Art. 51–55 | Providing the model adds Art. 53 (and Art. 55 above the systemic-risk threshold); building on someone else's model adds nothing. |
| Is it a product, or a safety component, under the Annex I laws? | Art. 6(1) | Where that law requires third-party conformity assessment, the Art. 6(1) route makes product-embedded AI high-risk. |
| Annex III area, and the Art. 6(3) exception | Art. 6(2)–(3) | Sets the high-risk tier under Art. 6(2); a narrow-task exception removes it unless the system profiles natural persons. |
| Your role, and what you did with the system | Art. 3, Art. 25(1) | Provider, deployer, importer, distributor or authorised representative. For a deployer, importer or distributor, putting your own name on it, substantially modifying it or changing its purpose to a high-risk one makes you the provider under Art. 25(1) — the heaviest obligation set. |
| Public body, or private provider of a public service? | Art. 26(8), Art. 27 | Asked of a deployer of a high-risk system. Decides whether it owes a fundamental-rights impact assessment before first use, and — for a public authority — registration of its use. |
| Does personal data flow through the running system, and in what role? | GDPR Art. 4, 26, 28 | Generates the GDPR rows — lawful basis, special categories, automated decisions, processor contract, DPIA, transfers — beside the EU AI Act ones. |
| People talk to it | Art. 50(1) | Tell people they are dealing with an AI system. |
| It generates text, images, audio or video; realistic depictions; public-interest text | Art. 50(2), 50(4) | Machine-readable marking, and deepfake and public-interest text disclosure. |
| Emotion recognition or biometric categorisation | Art. 50(3) | Notification of the people exposed — and in workplace or education settings the practice may be prohibited under Art. 5. |
| It is used on workers | Art. 26(7) | Adds the deployer's worker-information duty. |
The transparency triggers are independent of the risk tier. A minimal-risk chatbot still owes Art. 50; a high-risk hiring tool that also generates content owes both its Annex III duties and the labelling duties. The engine layers them.
Your inventory
Each registered system is a row on AI systems — your role and its tier, its stage, its EU AI Act obligations and its GDPR duties (each done over total, never added together), its owner — and a card on the board view. Open it for the seven-tab record: Overview, Obligations, Risks, Incidents, Evidence, Documents, Activity. See AI systems: the register and the system record.
Once registered, the system's classification dossier opens with a sealed, tamper-evident first entry, and a classification evidence record is minted against its Art. 5 obligation — your audit trail starts on day one.