An AI inventory is the register of every AI system and use case in an organisation: what each one does, who is accountable, what data it uses, who is affected and how risky it is. It underpins any AI governance programme, from the EU AI Act to ISO/IEC 42001: without knowing what exists, you cannot classify, assess or oversee it. This tool turns the intake form into a row ready for the register.
How to use
- Name the use case and give the accountable role and the department.
- Describe the purpose, the system type, the vendor and the life cycle stage.
- Tick the data used, the people affected and the weight of the system in the decision.
- Give the preliminary EU AI Act tier, the human oversight and the next review date.
- Read the risk rating and follow-ups, then export the row as CSV for the inventory spreadsheet or the record as DOCX.
What each field asks for
| Field | What to enter |
|---|---|
| Use case name | A short name everyone in the organisation recognises. |
| Accountable role | The job title accountable for the use case, not the person name. |
| Department | E.g. Human Resources |
| Description and purpose | What the system does, why, and who uses the output. |
| System type | |
| Vendor | Optional. Who supplies the system, if it comes from a third party. |
| Life cycle stage | |
| Data used | Tick every type of data the system receives or produces. |
| People affected | Who is affected by the system outputs. |
| Weight in the decision | How much the system output decides about people. |
| Preliminary EU AI Act tier | If you do not know, leave it as not classified yet and use the classifier. |
| Human oversight measures | Who reviews, when, and with what power to change the result. |
| Next review | The date when the record will be reviewed. |
Example
A fictional logistics company, Nordvale Logistics, records a pilot of CV screening for warehouse vacancies, bought from a recruitment software vendor. The system uses personal data about applicants and recommends, with a recruiter reviewing, and the preliminary tier ticked is high risk. The tool gives a high internal risk rating and lists three follow-ups: carry out a data protection impact assessment, run the AI vendor due diligence questionnaire and ensure AI literacy for the people who operate the system.
When to use
- When you build your first AI inventory, department by department.
- When someone proposes a new AI use or a pilot with a vendor.
- To bring unapproved AI uses found in the organisation into the register.
- At the periodic inventory review, to update stage, data and oversight.
Frequently asked questions
What should an AI inventory contain?
At least: use case name and purpose, accountable role, system type and vendor, life cycle stage, data used, people affected, weight in the decision, risk classification, human oversight measures and review date. The tool produces these columns.
How is the internal risk rating calculated?
With simple rules: high when the EU AI Act tier is high-risk or prohibited, when there are automatic decisions on personal data, when children are affected and personal data is used, or when special category data weighs on the decision. Medium when there is personal data, automatic decisions, a transparency obligation or no classification in production. Everything else is low.
Is an AI inventory mandatory?
The EU AI Act does not use the term, but the obligations of providers and deployers assume you know which systems exist and which tier each falls into. ISO/IEC 42001 and the NIST AI RMF also start from this mapping.
How do I combine several records in a spreadsheet?
Export each record as CSV: the file has one header row and one register row, always with the same columns. Paste the register rows one below the other in the inventory spreadsheet.
Is the result legal advice?
No. It is an educational tool, and the risk rating is an internal indication. The EU AI Act classification and impact assessments need validation by whoever is responsible for compliance in your organisation.
Which DPCert certification covers the AI inventory?
RAIF (Responsible AI Foundation), the entry-level certification, covers roles and accountability in the use of AI. RAIP (Responsible AI Practitioner) goes deeper into the AI system life cycle and inventory.