AI Inventory: How to Build an AI System Register for the EU AI Act
Head of Innovation
Digital Transformation, AI, IoT, Machine Learning, and Cloud Technologies. Nearly 15 years driving innovation
An AI inventory, in governance terms, is a register of every AI system your organisation develops, buys or uses, with an owner, purpose, data, risk tier and role recorded for each. You cannot classify, control or disclose AI you do not know about. (This guide covers governing AI systems, not AI for stock management.)
Key takeaways
- An AI system register lists each AI system with its owner, vendor, purpose, users, data categories, risk tier, your role and review date.
- Deployer duties under Article 26 of the EU AI Act, risk classification and Article 50 disclosures all assume you know what AI you run.
- Most AI enters through side doors: SaaS feature updates, browser extensions, personal ChatGPT accounts and developer API keys. Discovery needs several sources, not one survey.
- Start with a spreadsheet; move to an ITSM, CMDB or GRC tool once the register is stable and you need workflows.
- An inventory decays fast. Tie updates to procurement, change management and a quarterly owner attestation.
What an AI inventory is (and what it is not)
Search for "AI inventory" and half the results are about forecasting stock levels with machine learning. That is a different topic. Here, an AI inventory, also called an AI use case inventory or AI system register, is a governance record. It answers four questions for every AI system in the organisation: what is it, who owns it, what does it do with which data, and which rules apply to it.
The EU AI Act defines an AI system in Article 3(1) as a machine-based system designed to operate with varying levels of autonomy, that may adapt after deployment, and that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions. The European Commission's guidelines on the AI system definition help with borderline cases, such as simple rule-based automation that falls outside it. When in doubt, include the system in the inventory and record why you think it is or is not AI. Over-inclusion costs a row in a spreadsheet; omission can cost far more.
Need expert help with ai inventory?
Our cloud architects can help you with ai inventory — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
Why you need an AI system register
The register is the input to almost every other AI governance activity.
- Classification. Each system must be placed in a risk tier. Stand-alone high-risk systems listed in Annex III, such as CV screening or credit scoring, carry the heaviest obligations from 2 December 2027 under the Digital Omnibus timetable. See what makes an AI system high-risk.
- Deployer duties. Article 26 requires deployers of high-risk systems to follow the provider's instructions, assign competent human oversight, monitor operation, keep logs for at least six months, inform workers before workplace use and tell affected people. You cannot assign oversight to a system nobody has listed.
- Role mapping. You may be a deployer of one system and a provider of another, for example a support chatbot your team built on a large language model. The register records which role applies; our guide to provider and deployer obligations explains what follows from each.
- Transparency. Article 50 duties, applying since 2 August 2026, cover chatbots, deepfakes and certain AI-generated text. A column in the register flags which systems need a disclosure.
- Shadow AI and GDPR. Unlisted tools are where personal data leaks happen. The register overlaps with your GDPR record of processing activities and should link to it rather than duplicate it.
- AI literacy. Article 4 measures are aimed at the people who operate AI. The users column tells you who needs training.
The register is also the first thing any structured review asks for. An EU AI Act gap analysis starts with it, and so does Opsio's free EU AI Act readiness assessment, which asks how you track AI use as one of the ten governance areas it scores.
How to discover the AI you already use
A single email asking "what AI do you use?" will find perhaps the obvious tools. Combine several sources and cross-check them.
Procurement and finance records
Search purchase orders, contracts and expense claims for AI vendors and for keywords like "AI", "GPT", "copilot", "assistant", "machine learning" and "predictive". Expense claims are where individual ChatGPT Plus or Midjourney subscriptions show up.
SaaS, SSO and network logs
Your identity provider shows which applications staff sign into. A secure web gateway, CASB or DNS logs show traffic to AI services such as chat.openai.com, gemini.google.com or claude.ai, including from accounts that are not company-managed. Look for volume, not single visits.
Browser extensions and desktop apps
Endpoint management tools can list installed browser extensions. AI writing assistants, meeting recorders and "summarise this page" plug-ins often have permission to read everything in the browser, including web mail and internal systems.
Copilot and ChatGPT accounts
Check licence assignments for Microsoft 365 Copilot, ChatGPT Enterprise or Team, Gemini for Workspace and similar. Record which groups have access and which data sources the tool can reach, for example SharePoint sites and mailboxes in the case of Copilot.
AI embedded in existing vendor products
This is the category most inventories miss. CRM, HR, finance, ticketing and marketing platforms regularly add AI features, sometimes switched on by default. Read release notes, ask account managers directly, and add AI questions to vendor reviews. An applicant tracking system that starts ranking candidates has turned an ordinary HR tool into a potentially high-risk one.
Developer and data teams
Ask engineering and data teams about model APIs (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Google Vertex AI), internally trained models, and AI coding assistants. Cloud billing and API-key inventories confirm what is actually running.
A short owner survey
Finally, ask each department head to confirm and add to what you found. Keep it to five questions and promise that disclosure will not be punished; you want the shadow AI out in the open.
AI system register fields
These fields cover what the EU AI Act, GDPR and normal IT governance need. Use them as column headings; add free-text notes where a value needs explaining.
| Field | What to record | Why it matters |
|---|---|---|
| System name and ID | Product and module, version or model if known | Unique reference for audits and incidents |
| Business owner | A named person, not a department | Accountability for use and reviews |
| Vendor | Supplier, underlying model provider if known, contract reference | Supply-chain checks and instructions for use |
| Purpose | What the system does and which decisions it informs | Drives risk classification |
| Users | Teams or roles that operate it; number of users | Training scope and access control |
| Affected persons | Customers, applicants, employees, public | Notification and impact assessment needs |
| Data categories | Inputs and outputs, data classification level | Security and confidentiality controls |
| Personal data (Y/N) | Yes or no, special-category data flagged, link to record of processing | GDPR lawful basis, DPIA, transfers |
| Risk tier | Prohibited / high-risk / transparency / minimal, with reasoning | Determines which obligations apply and when |
| Role | Provider, deployer, importer, distributor | Determines whose obligations you carry |
| Article 50 applicable | Chatbot, deepfake, generated text, emotion recognition: Y/N and disclosure in place | Transparency duties applying since 2 August 2026 |
| Human oversight | Named reviewer(s) and their authority | Article 26(2) for high-risk systems |
| Logging and retention | Where logs live and for how long | At least six months for high-risk deployers |
| Contracts and documents | DPA, AI terms, instructions for use, risk assessment link | Evidence trail |
| Status and review date | Pilot, live, retired; next review | Keeps the register current |
An example row: "TalentRank CV screening module in our applicant tracking system; owner Head of Talent; vendor [ATS provider]; ranks applicants for recruiter shortlists; used by 12 recruiters; affects job applicants; personal data yes, includes CVs; risk tier high-risk (Annex III point 4, employment); role deployer; Article 50 no; oversight: senior recruiter reviews every shortlist; logs held by vendor for 30 days (gap); review March 2027." One row already exposes a compliance gap, which is exactly the point.
For high-risk and high-impact rows, link each entry to a documented risk assessment. Our AI risk assessment template shows what that record should contain.
Keeping the register alive
An inventory that is accurate on the day you finish it will be wrong within a quarter. Build it into processes that already exist:
- Procurement gate. No purchase or renewal of software with AI features without a register entry and a vendor review.
- Change management. A new AI feature, a model change or a new use of an existing tool triggers an update and, if needed, reclassification.
- Quarterly owner attestation. Each owner confirms their entries are correct, in a two-minute check.
- Technical monitoring. Re-run the SSO, network and extension scans every quarter and compare the results with the register.
- Retirement. Mark systems as retired rather than deleting them, and keep their records for the period your retention policy sets.
Give one person overall ownership of the register, often the AI governance lead, the CISO or someone in the compliance team. Shared ownership usually means no ownership.
Tooling options: from spreadsheet to GRC
| Option | Good for | Limits |
|---|---|---|
| Spreadsheet | First inventory, up to a few dozen systems, fast start | No workflow, weak version control, easy to fall out of date |
| List tool (SharePoint list, Airtable, Notion database) | Forms for new requests, simple approvals, shared access | Reporting and audit trail are basic |
| ITSM or CMDB | Linking AI systems to applications, owners and change tickets | Needs custom fields for risk tier, role and Article 50 |
| GRC platform | Larger organisations; links to risks, controls, policies and evidence | Cost and set-up effort; worth it once the process is stable |
The tool matters less than the discipline. Start in a spreadsheet with the fields above, prove the process for two quarters, then migrate.
Frequently asked questions
What is an AI inventory?
In governance, an AI inventory is a register of all AI systems an organisation develops, buys or uses, with key facts recorded for each: owner, vendor, purpose, users, data, risk tier and role under the EU AI Act. It is the starting point for classifying systems, assigning controls and showing regulators and customers that AI use is under control.
Does the EU AI Act require an AI inventory?
The Act does not use the phrase "AI inventory" as a general requirement. In practice, you cannot meet obligations such as Article 4 AI literacy measures, Article 26 deployer duties or Article 50 transparency without knowing which AI systems you use. Public authorities and providers of high-risk systems also have registration duties in the EU database.
What is the difference between an AI use case inventory and an AI system register?
The terms are often used interchangeably. Strictly, a use case inventory lists what AI is used for, while a system register lists the systems themselves. One system can support several use cases with different risk levels; Copilot drafting emails is not the same as Copilot summarising HR investigations. Record use cases as separate rows when their risk differs.
How do you find shadow AI in an organisation?
Combine expense and procurement records, SSO and network logs showing traffic to AI services, endpoint scans for browser extensions, licence data for tools like Copilot or ChatGPT Enterprise, and a short amnesty-style survey. Then give people an approved alternative, or the tools will come back.
How often should the AI register be updated?
Continuously through procurement and change management, with a full review at least quarterly. Ask owners to confirm their entries each quarter and re-run technical discovery scans at the same time. Reclassify a system whenever its purpose, users, data or vendor model changes significantly.
Start your AI inventory with a baseline
A register tells you what you have; the next question is how well it is governed. Take Opsio's free AI governance assessment to get a maturity score across ten governance areas in about 40 minutes, and four editable Word documents written from your answers: an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template. Free, no card and no obligation. For the wider context, see our EU AI Act guide.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Dates and obligations are stated as of October 2026.
Related Articles
About the Author
Head of Innovation
Jacob leads innovation at Opsio, specialising in digital transformation, AI, IoT, and cloud-driven solutions that turn complex technology into measurable business value. With nearly 15 years of experience, he works closely with customers to design scalable AI and IoT solutions, streamline delivery processes, and create technology strategies that drive sustainable growth and long-term business impact.
Editorial standards: This article was written by a certified practitioner and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
