EU AI Act Readiness
An AI Register That Maintains Itself
Risk-tier classification, NIST AI RMF impact levels, and approval status for every AI system in use - auto-populated from fleet discovery rather than a spreadsheet.
The Situation
Register Obligations Meet Decentralized Adoption
The EU AI Act asks organizations to know which AI systems they use, classify them by risk, and keep that classification current. NIST AI RMF asks a structurally similar question about impact.
Both assume an inventory. In most organizations that inventory is a spreadsheet updated during the last review cycle, describing a fleet that has changed since.
What Goes Wrong Today
The Spreadsheet Ages Immediately
- Manual entry. Systems get added when someone remembers, which is a subset of when they get adopted.
- No discovery input. Nothing feeds the register from what is actually installed and running.
- Stale classification. Risk tiers are assigned once and never revisited as usage changes.
- No evidence trail. The register asserts a state without anything to support it.
What Kraitos AIDR Does
Discovery Feeds the Register
| Field | Values |
|---|---|
| Risk tier | prohibited · high · limited · minimal · unclassified |
| NIST impact | high · moderate · low · unset |
| Approval status | approved · review · shadow |
| Discovery | auto (found by the agent) · manual (added by an admin) |
- Auto-discovered systems land as shadow / unclassified and enter the review queue automatically
- Manual entries cover AI systems the endpoint agent cannot see, such as vendor-embedded models
- Register state feeds the same evidence engine as every other control, with drift alerting
- EU AI Act and NIST AI RMF sit alongside SOC 2, ISO 27001, NIST 800-53, PCI DSS, and HIPAA in one coverage view
What You End Up With
A Register You Can Defend
- Which AI systems are in use across the organization right now?
- What risk tier does each carry, and who approved it?
- Which newly discovered systems are waiting in the review queue?
- What evidence supports the register entries if a regulator asks?
See Kraitos AIDR in Action
Deploy in 60 seconds. Get answers in 24 hours. Stop guessing what your AI-augmented organization is doing.
[email protected]kraitos.io