How does the EU AI Act module fit with the supplier register?

Two registers, one direction of flow.

The module owns the AI system. Name, description, kind and the whole classification — the interview, the draft risk tier, the obligation checklist, the evidence, the dossier — live in the EU AI Act module. That is where you accept a classification and where it becomes a determination with your name on it.

The supplier register owns everything around it. The moment an AI system exists in the module, a row for it appears under systems and services, marked with the module’s name. There you link the suppliers it depends on — the model provider, the hosting, the identity provider — read their documents, watch them for changes, record SLA levels and support contacts, and export the whole thing as a PDF package. Delete the AI system in the module and its row follows; rename it and the row is renamed. The supplier register never edits the AI system itself.

Why it is built this way. The AI Act asks a deployer to know its providers and a provider to know its own supply chain (Article 25 and the Annex IV documentation); GDPR Article 28 and NIS2 Article 21 ask the same question about every supplier, AI or not. One register answers all of them, and the module adds only what is specific to the regulation. GDPR and NIS2 modules will sit on the same foundation.