Let’s talk about the public list every consequential algorithm is supposed to be on — and why almost nobody is checking it.
There is this moment that happens thousands of times a day now. A person applies for a loan. Or a rental. Or a job. And somewhere in a server room they will never see, a system they have never met makes a call. No meeting. No appeal. Just a score, handed to a stranger who believes it.
That was the whole problem in one picture: the most important decisions about your life, made by a machine you can’t see, can’t question, and can’t leave.
Last weekend, in the European Union, part of that changed. On the second of August, the high-risk obligations of the AI Act went live. From that day, AI systems that decide who gets hired, who gets credit, who gets into a school, who gets flagged by the police — they have to carry documented risk management. Data governance. Logging. Conformity assessment. A human with real authority in the loop.
And they have to register. Before they go to work, they go on a public EU database. A list of every consequential algorithm, with a name, a purpose, and paperwork that exists outside the company that built it.
That database is the part almost nobody is talking about. And I think it’s the whole story.
For twenty years, the complaint has been that the profile is invisible. You get scored, categorized, priced — and you never see the score. The list doesn’t fix that overnight. But it is the first time in a major economy that the algorithm itself has to sign in. It has to exist on a public record, with a reason for being. That’s not nothing. That’s an inversion: from invisible scorer to listed decision-maker.
Now here’s what people are missing.
The list is only as honest as the people filling it. The AI Act lets providers classify their own systems. If you build an AI and you decide it doesn’t do the kind of profiling the law cares about, you can declare it not high-risk. No registry. No paperwork. Just a judgment call, made by the people selling the system.
Every vendor’s legal team is reading that clause right now. And here’s the prediction: the first dodgers won’t refuse to register. They’ll file as “not high-risk.” The registry will end up being a map of who’s playing straight — and who’s playing the definition.
That matters more than it sounds. Because registration isn’t just bureaucracy. It’s provenance. It’s the first time a consequential algorithm has to exist on a record that isn’t controlled by the people who made it. A public list can be audited. Questioned. Quoted in a hearing. Shown to a journalist.
Nobody is going to read the list on the day they get denied a loan. The list won’t save that specific Tuesday. But it changes the math for the people who build the systems, and that’s the direction that matters.
You cannot consent to what you cannot see. That’s the principle underneath all of this. And for the first time, in one place on earth, the machine has to show its face before it gets to decide yours.
So here’s the operator question. If you build with AI — and you do, even if you don’t call it that — ask yourself: is what you’re running the kind of system that would end up on that list? And would you be proud to file the paperwork?
The companies that treat the registry as a compliance chore will miss the real move. The list is going to become a trust signal. In five years, “is it on the list, or provably not required to be” is going to be a procurement question, a hiring question, a due-diligence question. The firms that got there first will own the category. The ones that fought the paperwork will be explaining themselves for a decade.
And for the rest of us, the move is simpler. The list exists. Go look at it. The machine has been watching you your whole life. It’s our turn to watch it back.