Build an AI inventory
An inventory is a shared record of actual AI use. It helps you agree rules, identify missing information and select uses that need closer assessment. Start with what colleagues and available records can tell you; mark incomplete entries for follow-up.
1. Define the scope
Agree which teams to involve, who will compile the record and where it will be kept. Include current tools, experiments and planned uses. Distinguish their status so a proposal is not mistaken for approved operation.
Include AI features in everyday business software, supplier solutions and systems developed internally. One tool can serve several purposes: drafting public copy and processing personal data deserve separate entries or clearly distinguished uses.
Output: an agreed scope and responsibility for maintaining the inventory.
2. Ask about actual work
Ask about tasks, not just application names. Short interviews, questionnaires, licence records, contracts and system information can help.
- What work does AI help you with, and how often?
- What do you put into the tool and take from it?
- Who checks the result and who uses it next?
- What happens if the result is wrong or the tool is unavailable?
- What do you still need to know about the tool or its rules?
Explain the purpose of the exercise and agree how to address problems. Conversations about everyday work often reveal AI use outside the organisation’s view.
Output: a list of uses with a contact who can supply further information.
3. Complete a record for each use
Copy this table into an existing record system. Choose a tool based on access, change tracking and the scope you need; see tools for maintaining records.
| Field | What to record |
|---|---|
| Identification | Name, internal reference and status: proposed / pilot / in use / retired |
| Purpose | The specific task and intended result |
| Tool | Supplier, service plan or version in use and available documentation |
| People | Team, users, accountable person and a contact for missing information |
| Inputs | Data types, their source and any personal or confidential data |
| Data handling | Where data is processed and retained, who may access it and what remains unknown |
| Outputs | Who receives them, how they are checked and how they affect work or decisions |
| Conditions of use | Approval, restrictions, access, integrations and how to report problems |
| Evidence | Links to contracts, settings, rules and existing assessments |
| Open questions | Missing information, who will obtain it and by when |
| Updates | Last review date and the trigger for the next review |
Do not put passwords, API keys or real sensitive samples in the inventory. Describe the data type and link to protected evidence with appropriate access controls.
4. Identify what needs assessment
Separate established facts from working assumptions. “We do not know whether the supplier retains data” calls for checking terms or settings. It must not silently become “data is not retained”.
Legal classification depends on the system, its purpose and the organisation’s role. A general internal rating of “low / medium / high risk” does not replace assessment under the AI Act. Continue with the classification guide. Where personal data is processed, also assess GDPR; address an Article 28 agreement where the supplier acts as a processor.
Output: questions, actions and uses that need specialist assessment, each with an assigned owner.
5. Keep the record current
Agree updates when a tool, purpose, data, supplier or responsibility changes, and when a problem is found. Set periodic reviews according to scope and risk. The number of entries alone does not show whether the record matches reality.
- Every use has a purpose, status and accountable person.
- Input data, use of outputs and checks are described.
- Missing information has an owner and a follow-up date.
- Decisions and restrictions can be traced.
- People know how to report a new use or change.
Prepare company rules · AI Act checklist · More templates
Primary sources: AI Act — informative consolidated version 27 July 2026; Regulation (EU) 2026/1744 — published 24 July 2026; GDPR — published version 4 May 2016. This inventory is a working aid for assessing the relevant role and duties.