An AI Inventory in Two Weeks: The Task the Omnibus Did Not Postpone
The Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026, entering into force on 27 July 2026) moves the date most boards quote: high-risk systems under Annex III of the AI Act (Regulation (EU) 2024/1689) get until 2 December 2027 instead of 2 August 2026. Many management teams read this as permission to slow down. One task stays on the old clock: the inventory of the AI systems in actual use, because without it nobody can say which of the Act’s dates applies to the company.
The list decides which rules apply
The AI Act assigns duties by role and by risk class. A provider of a high-risk system carries the heaviest package, a deployer a lighter one, and a company running a chatbot mostly owes the transparency duties of Article 50. None of these labels can be assigned in the abstract; each attaches to a concrete system with a concrete purpose and concrete data. Picture the board meeting where the question lands: how many AI systems do we run? The CIO says four. The head of HR adds that the recruitment platform “scores candidates somehow”. Marketing has been generating copy inside its planning suite for a quarter. Then someone opens the expense report and finds dozens of SaaS subscriptions, many of which shipped AI features over the past year without a single new contract. The distance between the official answer and the real list is the company’s actual AI Act exposure, and the board owns that gap, because the board assigns owners and budget.
What the omnibus moved, and what it left alone
The omnibus shifts Annex III high-risk compliance to 2 December 2027 and high-risk systems embedded in regulated products under Annex I to 2 August 2028. Systems placed on the market before 2 August 2026 get until 2 December 2026 to meet Article 50. The rest stands. Prohibited practices have applied since 2 February 2025. Duties for general-purpose AI models have applied since 2 August 2025. Systems placed on the market from 2 August 2026 must meet Article 50 from day one: users told they are talking to a machine, synthetic content marked in machine-readable form, deepfakes labelled. For a company with a customer chatbot or a content generator, the operative dates are days away, whatever happens to Annex III.
A workable inventory takes two weeks
Week one is collection. Four sources catch nearly everything: procurement and expense data, the IT asset register, the SaaS contract folder, and a short survey asking team leads which tools score, rank, generate, predict or decide. Record every hit in a minimal format: purpose, data in and out, the company’s role (provider or deployer), supplier, users, internal owner. Week two is triage: sort the list into prohibited-practice checks, Annex III candidates, systems with Article 50 duties and the rest, then flag every tool built on a general-purpose model. The output is one register and one page of open questions. Skip this step and the 2027 date tells you nothing, because you still do not know whether it is your date.
What we recommend now
All five steps fit into the two-week window:
- Name one owner of the AI register this week, with a mandate to question every team, including HR and marketing.
- Pull the four source lists within days: expenses, IT assets, SaaS contracts, team survey.
- Record each system in the minimal format; a spreadsheet carries the first version.
- Run a first-pass classification and mark everything that touches Article 50: chatbots, content generation, synthetic media, plus tools built on general-purpose models.
- Put the register on the next board agenda with a date assigned to each system, and set a quarterly refresh.
Sources: Regulation (EU) 2026/1744 (EUR-Lex) · European Commission: Regulatory framework for AI