Introduction
Since the transparency obligations under Regulation (EU) 2024/1689 became applicable on 2 August 2026, legal and compliance teams have faced a practical question that a policy alone cannot answer:
For any given AI use case, who owns the obligation, at which legal entity, under which control, and with what evidence?
An AI Act compliance register provides the operational structure needed to answer these questions.
It connects applicable obligations to identifiable legal entities, named owners, defined controls, scheduled reviews and retained evidence.
For organisations operating across multiple entities, this creates a more consistent way to translate AI governance policies into accountable, trackable activities.
Key Takeaways
- Inventory AI use cases by business unit and legal entity.
- Translate applicable obligations into discrete register entries.
- Assign named owners and approvers.
- Define controls, review schedules and escalation paths.
- Attach evidence and maintain an audit trail.
What Is an AI Act Compliance Register?
An AI Act compliance register is a structured, maintained record that translates applicable AI governance obligations into discrete, assignable and trackable entries. Where an AI policy establishes organisational commitments, the register documents how those commitments are operationalized. For each relevant AI use case, it records the applicable obligation, responsible legal entity, named owner, defined control, review schedule and supporting evidence. A policy states the commitment. A register records who is responsible for carrying it out, how it is reviewed and what evidence is retained. The register is an operational governance tool; it does not replace the legal assessment needed to determine which obligations apply.
Why Entity-Level Structure Matters for AI Act Compliance
What Should an AI Act Compliance Register Contain?
An effective register should capture the information needed to assign, review and evidence each applicable obligation.
| Step | Activity |
|---|---|
| 1 | Inventory AI use cases by business unit and legal entity. |
| 2 | Translate applicable obligations into discrete register entries. |
| 3 | Assign named owners and approvers. |
| 4 | Define controls, review schedules and escalation paths. |
| 5 | Attach evidence and maintain an audit trail. |
Five Steps to Build an AI Act Compliance Register
Step 1: Inventory AI Use Cases by Business Unit and Legal Entity
Begin by identifying AI systems used across the organisation. Work through each business unit and legal entity to establish which systems are in use, who deployed them and which policy obligations may apply. The inventory should identify the relevant entity and responsible business function for every use case. An obligation cannot be assigned effectively until the organisation has established which entity and system it concerns.
Step 2: Translate Obligations Into Discrete, Assignable Entries
Broad policy statements should be translated into specific register entries. A single policy clause may require multiple entries where different AI systems, legal entities or operational responsibilities are involved.
Each entry should identify the applicable obligation and the action required to manage it.
This allows teams to track implementation and review activities individually rather than relying on a general statement of compliance.
Step 3: Assign Owners and Approvers at the Entity Level
Every register entry should have a named owner linked to the relevant legal entity. Where appropriate, a separate approver should be assigned to provide oversight. Assigning responsibility only to a department such as Legal or Compliance can leave accountability unclear.
Named ownership establishes who is responsible for maintaining the entry, completing reviews and addressing outstanding actions.
Step 4: Define Controls, Review Cadence and Escalation Paths
Each obligation should be associated with a specific control and a defined review schedule. Rather than leaving an entry marked as ongoing, establish a review date and cadence appropriate to the obligation. The register should also identify what happens when a review becomes overdue or an exception is identified.
Defined escalation paths help ensure that outstanding actions are routed to the appropriate individual for resolution.
Step 5: Attach Evidence and Maintain the Audit Trail
Evidence should be connected directly to the relevant register entry. Supporting records may include completed reviews, approvals, control documentation or other materials appropriate to the obligation.
As evidence changes, the register should preserve relevant dates and version history. An entry without supporting evidence records an assertion. An entry with retained evidence and a dated history provides a more useful record for internal review and audit preparation.
Common Failure Points in Spreadsheet-Based Compliance Registers
Spreadsheets can support an initial inventory, but maintaining an operational compliance register across multiple entities introduces additional challenges.
Common failure points include:
- Ownership recorded only at department level.
- Multiple versions circulating across teams.
- Review dates becoming outdated.
- Evidence stored separately from the relevant obligation.
- Limited visibility into overdue actions.
- Group-wide records lacking legal entity structure.
These gaps can make it difficult to establish a consistent view of ownership, controls and evidence over time.
The underlying challenge is not simply the format. It is maintaining a governed relationship between obligations, accountable individuals, review activities and supporting records.
How RazorSign Supports Compliance and Legal Entity Management
RazorSign connects compliance obligations with entity-level ownership and operational oversight through three complementary capabilities.
Compliance Management turns policy obligations into assigned entries with controls, review schedules and a retained audit trail.
Legal Entity Management anchors obligations to the correct legal entity and accountable officer.
Legal Operations Management provides a portfolio view of current, due and overdue obligations across entities.
Together, these capabilities support a structured approach to compliance ownership, monitoring and evidence management. AI Act classification and the determination of applicable legal obligations remain matters for legal assessment.
What should an AI Act compliance register contain?
A register should contain the applicable obligation, source provision, legal entity, named owner and approver, control, review date, evidence link and current status.
Who should own AI governance obligations?
How should AI Act obligations be tracked across legal entities?
What is the difference between an AI policy and a compliance register?
How often should an AI compliance register be updated?
Does a compliance register replace legal judgment?
Why do spreadsheet-based compliance registers become difficult to maintain?
Can the same register structure support other regulations?
Conclusion
An AI Act compliance register turns a published policy into an operational record that can be maintained and reviewed across legal entities.
It begins with an accurate inventory, translates applicable obligations into discrete entries, assigns named ownership and establishes defined controls and review schedules.
Retaining evidence against each entry completes the connection between policy commitments and operational accountability.
For legal and compliance teams, the objective is clear: establish who owns each obligation, how it is managed, when it is reviewed and what evidence supports it.
Bring Structure to AI Compliance Management
Discover how RazorSign connects compliance obligations with entity-level ownership, defined controls, review schedules and retained evidence.
