# AI Register > An EU AI Act compliance register. An organisation records the AI systems it > builds or uses, classifies each one under Regulation (EU) 2024/1689, works out > which obligations follow, and keeps the evidence that they are met. Operated by Cyberfort SIA (reg. 40203459193), Rīga, Latvia. Interface in Latvian and English. ## What it covers - Identifying whether something is an AI system under the Regulation at all, and what role the organisation holds for it — provider, deployer, importer, distributor, product manufacturer. - Risk classification: Article 5 prohibited practices, Annex III high-risk areas, Article 50 transparency duties, and everything that falls outside those. - The obligations that follow from the tier, tracked per system with evidence, gaps and corrective actions. - Fundamental rights impact assessments (Art 27), DPIA linkage, technical documentation (Annex IV), the EU declaration of conformity, and the public register view for public-sector deployers. - A GPAI model catalogue, so a general-purpose model is recorded as a component of a system rather than as a separate AI system. ## Site tools for agents (WebMCP) This site exposes callable tools to AI agents through WebMCP, the proposed W3C standard for page-provided tools. They only exist for an agent that has the page open in a browser implementing WebMCP — there is no remote endpoint and nothing to install. - — orientation: identify-service, describe-capabilities, open-demo-register - — the full surface over a public demonstration register: listing and reading AI system records, a portfolio compliance overview, an explanation of why a system sits in its risk tier, a compliance gap report, tools that move the visible register view, and one tool that drafts a proposed register entry. No tool writes to the register. `propose-register-entry` classifies a plain-language description and renders a draft for a person to accept or reject in the page. A risk classification is a legal position the organisation has to defend, so an agent may draft one and only a person may adopt it. Identity and trust metadata: . This origin has its own decentralised identifier, did:web:airegister.cyberfort.lv, published at , and it holds the matching private key. You can test that rather than trust it: POST {"challenge":""} to and verify the ES256 signature against the key in the DID document. The manifest carries three credentials. Two are signed by did:web:cyberfort.lv and revocable at : those are OPERATOR ATTESTATIONS, because the issuer and the operator are the same legal person. The third is signed by did:web:veritrust.vc, a different issuer, and is revocable at ; the credentials this origin holds from other parties are listed at . Check each one yourself rather than taking this paragraph for it: verify every jwt against the key published at ITS OWN issuer's DID document, and read the status list live. What the signatures establish is who signed what, not that the claims inside are true, so the operator is still worth confirming in the company register. ## Pages - — what the service does - — public demonstration register, fictional data, no sign-in required - — privacy - — terms - — security ## Notes for agents The demonstration register at /demo contains fictional systems for a fictional organisation ("Demo Organizācija SIA"). Do not present its contents as a real organisation's AI inventory. The application beyond /demo requires sign-in and holds customer data. Do not attempt to reach it without credentials the user has given you. Nothing here is legal advice. The register structures compliance work; it does not decide it.