Topic starter
11/11/2026 6:06 pm
TL;DR: The EU AI Act compliance burden begins with discovery, with Lansweeper reporting that organizations cannot classify or document AI systems they have not inventoried. Practitioners need a continuously updated view of embedded, third-party, and local AI before governance can be credible.
Editorial analysis by NHI Mgmt Group, based on content published by Lansweeper: “EU AI Act Compliance: Your Updated Timeline and What to Do Now”.
Key questions
Q: Why do model changes create compliance risk under the EU AI Act?
A: Because substantial modifications can reclassify a deployer as a provider under Article 25.
Q: How should organisations classify AI systems for EU AI Act compliance?
A: Start with intended use, not technical complexity.
Q: How should organisations prepare their AI inventory for EU AI Act compliance?
A: Start by building a complete inventory of every AI system in use or development, then classify each one by risk level and business purpose.
Practitioner guidance
- Create a single AI system inventory Record every embedded, standalone, and third-party AI capability across SaaS, cloud, endpoints, and internal applications in one governed register.
- Bind each AI system to named ownership Assign business owner, technical owner, and operating role for every AI capability so provider and deployer responsibilities do not drift apart.
- Classify AI by use and impact Apply a risk review that considers purpose, affected users, autonomy, and regulatory scope before documenting obligations or controls.
Bottom line: The EU AI Act turns AI discovery into a prerequisite for compliance, because invisible systems cannot be classified, documented, or audited.
Glossary terms: EU AI Act, Provider, Deployer, General-Purpose AI Model
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
AI inventory debt: organisations are accumulating a governance debt when AI capability is embedded in tools faster than it is recorded. The real problem is not the presence of AI itself, but the absence of a system of record that ties each capability to an owner, a role, and an evidence trail. That is why inventory is the foundational control, not a side task for compliance teams.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to monitor embedded AI in SaaS tools?
A: The best way is to maintain a live inventory of every embedded AI feature, then tie it to approved data flows, tenant settings, and usage logs. Continuous asset reconciliation between SaaS contracts, admin consoles, and actual runtime activity reveals shadow deployments, over-permissioned connectors, and changes to model access that periodic reviews miss.
👉 Read our full editorial: EU AI Act compliance starts with a continuously updated AI inventory