What records should I keep, exactly?
The AI Act does not ask a private business that only uses AI tools made by others, none of them high-risk, to keep a list of them.
Drafted with AI help and checked against the official EU text before publishing.
The AI Act does not ask a private business that only uses AI tools made by others, none of them high-risk, to keep a list of them. If your business uses AI tools made by others and is not a public body or acting for one, Article 49 of the AI Act does not ask you to register them in the EU database.
Keeping simple, dated notes is still good practice, so you are ready if anyone asks: which AI tools you use, how your staff were helped to understand them, and how you tell people when AI is involved. High-risk systems have extra logging and record duties (Chapter III).
This is general information, not legal advice.
What the law actually says
Original text (2024), replaced 27 July 2026
"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf."
Amended. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) replaced Article 4. The duty is now to take measures to support the development of AI literacy, and it does not require you to guarantee any particular level. The quote above is the original wording — the European Commission has not yet published the consolidated text. We will quote it here the day they do.
— EU AI Act, Article 4 (original wording, amended 2026) (Regulation (EU) 2024/1689) · eur-lex.europa.eu"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."— Article 4(1) as replaced by Regulation (EU) 2026/1744, Article 1(5)
In plain words
- Good practice, not a legal duty: a short dated note of your AI tools, how your staff were helped to understand them, and how you tell people when AI is involved. Then you are ready if anyone asks.
- Article 4 asks for measures to support AI literacy. A note of what you did shows the steps you took.
- High-risk systems have extra logging and record duties (Chapter III).
- Will look for signs of AI use in the folders you choose, and write them down for you.
- Will write a plain-language readiness report. No evidence reads "Not assessed", never a green tick.
- Will run as a free Windows program on your own computer and send nothing from it.
- Coming with Guard: a check every month, kept so you can see your history and what changed since the last one.
- Coming with Guard: a printable readiness pack built from your check results — AI use found, training notes, disclosure checklist.
Did this answer your question?
Readiness guidance, not legal advice. The Free Toolkit sends nothing from your computer.