AI Act | AI Inventory

Guide for conducting an inventory of all AI systems in your organisation.

Why conduct an inventory?

An AI inventory is the first mandatory step for AI Act compliance. Without knowing all your AI systems, you cannot:

Classify risks
Determine obligations
Implement controls

Types of AI Systems

1. Internal AI (In-house)

AI systems developed or trained internally.

System	Examples
ML models	Fraud detection, recommendation, forecasting
Data pipelines	ETL with ML components, automated data quality
Analytics	Predictive analytics, churn prediction
Automation	RPA with AI, document processing

2. Third-party AI (External)

AI systems from external providers.

System	Examples
GPAI (General-purpose)	Claude, GPT-4, Gemini, Perplexity
SaaS with AI	Salesforce Einstein, HubSpot AI, Zendesk AI
Cloud AI services	AWS SageMaker, Azure ML, Google Vertex AI
Specialised AI	Jasper (content), Grammarly, GitHub Copilot

3. Embedded AI

AI systems embedded in products or tools.

System	Examples
Products	AI in customer-facing software
Hardware	Smart devices, IoT with AI
Open-source	Models from Hugging Face, TensorFlow Hub

Inventory Template

AI System Record

BASIC INFO

System ID: AI-[YYYY]-[NNN]
Name: [System name]
Description: [Brief description]
Type: [ ] Internal / [ ] Third-party / [ ] Embedded
Status: [ ] Development / [ ] Testing / [ ] Production / [ ] Retired

OWNERSHIP

Owner: [Name + role]
Department: [Department]
Vendor (if external): [Vendor name]

FUNCTIONALITY

Purpose: [Business use case]
Input: [What data enters]
Output: [What AI produces]
Users: [Who uses it --- internal/external]

DATA

Personal data: [ ] Yes / [ ] No
Special category: [ ] Yes / [ ] No
Data source: [Where data comes from]
Data storage: [Where stored]

RISK (preliminary)

AI Act category: [ ] Prohibited / [ ] High / [ ] Medium / [ ] Low
Affects fundamental rights: [ ] Yes / [ ] No
Autonomous decisions: [ ] Yes / [ ] No

DOCUMENTATION

Technical docs: [ ] Yes / [ ] No
Model card: [ ] Yes / [ ] No
DPA (if external): [ ] Yes / [ ] No

Inventory Table

AI ID	Name	Type	Purpose	Personal Data	Risk Level	Status
AI-2026-001
AI-2026-002
AI-2026-003

Inventory Process

Step 1: Identification (Week 1)

Step 2: Information Gathering (Week 2)

For each AI system, complete the inventory card:

Send a questionnaire to system owners
Conduct interviews with key stakeholders
Review documentation (if it exists)
Validate with IT technical details

Step 3: Classification (Week 3)

Preliminary risk classification:

Indicator	Probably High-Risk
Makes credit decisions	Credit scoring
Makes employment decisions	HR decisions
Makes health decisions	Health diagnostics
Makes education decisions	Education access
Uses biometrics	Biometric ID
Affects fundamental rights	Fundamental rights

Step 4: Documentation (Week 4)

Compile the inventory into a central database
Assign ownership for each system
Identify gaps in documentation
Plan follow-up for missing information

Inventory Checklist

Internal AI

Identify all ML models in production
Identify experiments/POC with AI
Check data pipelines for AI components
Review RPA processes for AI/ML
Audit internal analytics

Third-party AI

Embedded AI

AI in customer-facing products
Open-source models
AI in hardware/IoT
AI components in legacy systems

Common Findings

Finding	Action
AI without documentation	Create model card
AI without owner	Assign ownership
Shadow AI (unauthorised)	Review + approval or sunset
Missing DPA	Contact vendor
Unclear classification	Consult with Legal

Next Steps

AI Risk Assessment --- Form for evaluating risks of an AI system
High-Risk AI Checklist --- Checklist for high-risk AI systems

Tip: The inventory card above (AI System Inventory Card) can be used as a template for documenting each AI system. Copy it into your system and complete it for every identified AI system.