Introduction

In a context where artificial intelligence systems are massively integrated into the decision-making processes of public and private organizations, the question of their regulatory compliance has become a strategic issue of the first order. The entry into force of Regulation (EU) 2024/1689, known as the AI Act, on August 1, 2024 marks the most structuring regulatory turning point of the decade for any organization deploying AI systems in Europe.

The central question this article addresses is the following: how can an organization, in a rigorous and defensible manner, identify which AI systems it deploys, assess their risk level under the Regulation, and prioritize its compliance actions before the critical deadline of August 2, 2026?

The objective of this article is to propose a five-step structured methodology to conduct this mapping, from the initial inventory of systems to the establishment of continuous governance. Each step is based on the specific provisions of the official text of Regulation (EU) 2024/1689, enriched by the guidelines published by the European Commission on May 19, 2026.

I. General Overview: The AI Act and Its Stakes

1. Definition and Regulatory Foundations

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 constitutes the first comprehensive global legal framework dedicated to the regulation of artificial intelligence systems. Published in the Official Journal of the European Union on 12 July 2024, it establishes harmonized rules applicable across all Member States, creating a unified framework for the development, placing on the market and use of AI systems.

The Regulation adopts a risk-based approach that distinguishes four risk levels (unacceptable, high, limited and minimal) determining the regulatory regime applicable to each system. This pyramidal architecture is the cornerstone of any mapping exercise.

2. Importance and Stakes

Economic and financial stakes

The penalties provided by Article 99 of the Regulation are commensurate with the stakes. Non-compliance with provisions relating to prohibited AI practices exposes organizations to fines of up to 35 million euros or 7% of global annual turnover. Non-compliance with obligations applicable to high-risk systems can lead to penalties of up to 15 million euros or 3% of turnover.

Regulatory stakes

The AI Act sits within a context of regulatory convergence with the GDPR (Regulation (EU) 2016/679) and, for financial organizations, with the DORA Regulation (Regulation (EU) 2022/2554). AI flow mapping is the junction point of these three regulatory frameworks: a single well-conducted exercise can simultaneously serve all three compliance regimes.

Technological stakes

The shadow AI phenomenon, the undeclared use of AI systems by business teams without centralized supervision, makes declarative inventory alone insufficient. According to recent studies by the Gartner firm, more than 40% of enterprise AI usage in 2025 escapes centralized IT supervision.

II. Detailed Analysis: Classification and Scope

1. Current Situation and Regulatory Calendar

Regulation (EU) 2024/1689 follows a progressive application calendar, each stage of which generates specific obligations and compliance actions to anticipate.

2. Issues Encountered

The dual classification pathway (Article 6)

Article 6 defines two distinct pathways through which an AI system can be qualified as high-risk. Mastering these two pathways is essential to any exhaustive mapping.

Pathway 1, Article 6(1): An AI system constituting a safety component of a product covered by Annex I (medical devices, machines, lifts, vehicles, aircraft) is automatically high-risk if the product is subject to third-party conformity assessment.

Pathway 2, Article 6(2): A system belonging to one of the eight Annex III categories is presumed high-risk, unless the Article 6(3) exclusion clause applies.

3. Concrete Cases and Examples

III. Solutions and Recommendations: The 5 Mapping Steps

Step 1, Build the Team and Define the Scope

AI flow mapping goes well beyond the boundaries of IT alone. Systems likely to be high-risk are found in HR (recruitment, evaluation), Finance/Risk (scoring, actuarial), Operations (infrastructure supervision) and Legal. Building a multidisciplinary team from the start is a sine qua non condition.

• Sponsor: CISO or DPO depending on the organization
• Business representatives: HR, Finance/Risk, Operations, Marketing, Legal
• CIO / Enterprise Architect: technical inventory
• Specialized AI lawyer: interpretation of Articles 6, Annex III
• Executive committee: classification validation and budget arbitration

The scope must cover the organization both as provider (Article 3(3), develops or has developed) AND as deployer (Article 3(4), uses under its responsibility), the obligations differing substantially according to this role.

Step 2, Conduct the Exhaustive Inventory

Four complementary methods must be combined to ensure exhaustiveness:

1. Declarative questionnaire to business units, a structured form identifying AI tools (automation, NLP, vision, recommendation).
2. Analysis of purchases and contracts, review of SaaS licenses (Microsoft 365 Copilot, Salesforce Einstein, Workday, SAP SuccessFactors).
3. Technical review of the application portfolio, AI frameworks (TensorFlow, PyTorch, OpenAI API, Anthropic, Google).
4. Interviews with data science teams, internally developed models, automated pipelines.

Step 3, Classify Against the AI Act Risk Grid

Classification follows a sequential decision tree of eight questions:

1. Does the system execute a practice prohibited by Article 5? → Absolute prohibition
2. Is it a safety component in an Annex I product subject to third-party assessment? → High risk Art. 6(1)
3. Does it belong to one of the 8 Annex III categories? → Potentially high risk Art. 6(2)
4. If Annex III: does it perform profiling? → High risk without possible derogation
5. If Annex III and no profiling: does it meet one of the Article 6(3) exclusion conditions?
6. If yes to 6(3): mandatory documentation Art. 6(4)
7. Is it a GPAI model (Chapter V)? → Articles 53 and 55 obligations
8. Does the system generate content without transparency? → Art. 50

Step 4, Assess Exposure and Prioritize Actions

Step 5, Document, Register and Maintain Over Time

Article 49 requires the registration of high-risk AI systems in the public European database before placing on the market (providers) or putting into service (certain deployers). Annex VIII of the Regulation defines the information to be submitted.

Technical documentation (Annex IV) must cover 14 minimum headings: architecture, training data, performance metrics, risk management, robustness, cybersecurity, instructions for use, planned human oversight, post-market monitoring plan. This documentation must be updated at every substantial modification of the system.

Continuous governance

Three organizational mechanisms are essential to maintain the mapping over time:

• Pre-approval AI process, any new AI initiative goes through a classification review before development or purchase.
• Annual mapping review, complete audit of the inventory, update of classifications, alignment with NIS2 reporting cycles.
• Continuous regulatory watch, monitoring of publications from the European Commission (AI Office), the European Parliament and competent national authorities.

IV. Conclusion

Mapping sensitive AI flows under Regulation (EU) 2024/1689 goes beyond a simple regulatory obligation. It constitutes the foundation of responsible AI governance, the starting point of any credible compliance strategy, and the opportunity for every organization to take full measure of its algorithmic estate: its strengths, its vulnerabilities and its responsibilities.

The five steps presented in this article (build the team, conduct the inventory, classify against the AI Act grid, assess exposure, document for the long run) form a coherent and progressive process. They apply to any organization, regardless of initial maturity. The checklist provided is an immediately operational steering tool for CISO, DPO and compliance teams.

Yes, it is possible to rigorously map sensitive AI flows before August 2, 2026. The condition is simple: start now, adopt a multidisciplinary approach and treat this exercise as a strategic investment in the organization's resilience and competitiveness.

Organizations that engage in this approach today do not endure AI Act compliance. They use it to outpace competitors, reassure customers and secure contracts in an increasingly regulated digital environment. In a market where algorithmic trust is becoming a decisive differentiating factor, a well-conducted AI Act mapping is not a cost, it is an intelligence.

V. Bibliographic References

© 2026 Neo Coeur Intelligence, all rights reserved.
This article is provided for informational purposes only and does not constitute legal advice.
www.neocoeurintelligence.com