AI ACT EXPRESS COMMUNITY
Business owners answering each other.
A free question-and-answer space. Below are the questions that come up most often, each with a checked and sourced answer. Ask yours: it will be handled and published here.
RECENT QUESTIONS
What the community is working through today.
Do I have to list ChatGPT in my AI inventory?
Yes — but not because an article obliges you to. The regulation does not impose a general inventory on businesses that simply use a common AI tool. It imposes one for high-risk systems, which ChatGPT is not in itself. It is, however, your only way of knowing whether one of your uses tips over into high-risk one day — screening CVs, for example — and it is the simplest evidence of the measures you are taking under Article 4. A simple table is enough: the ready-made template has nine columns and takes twenty minutes to fill in.
How do I tell visitors that a chatbot uses AI?
Since 2 August 2026, a person must know they are talking to a machine, unless this is obvious to someone who is reasonably attentive. The obligation to design the system that way falls on its provider, but it is your site people will be looking at: check that the notice is there, and add it if it is missing. One sentence before the first exchange is enough — “You are talking to an automated assistant. To speak to a person, write to…” — displayed, not buried in the terms and conditions.
Is our CV screening tool high-risk?
Yes: Annex III explicitly places recruitment and candidate selection among the high-risk uses. But the obligations that go with it only apply from 2 December 2027 — the Digital Omnibus pushed them back by sixteen months. So you have time, and that is good news provided you do not confuse it with what already applies: the ban on emotion recognition in the workplace, in force since February 2025, and every candidate’s right not to be subject to a fully automated decision.
Which manager should keep the AI system inventory?
The regulation names no one: there is no mandatory “AI officer”, unlike the data protection officer. What matters is that one person is appointed and known to everyone — often the data protection officer where there is one, otherwise the head of IT or of quality — and that every tool listed in the inventory has, alongside it, a manager on the business side who knows what it is for.