Key facts

  • Start with a spreadsheet — a dedicated tool is not required to get value from an inventory.
  • Cover shadow AI: tools adopted by teams without formal procurement sign-off.
  • Record owner, purpose, data touched, and EU AI Act risk category for each system.
  • Use the free AI system inventory template to start immediately.
  • An inventory is a living document — review and update it at least quarterly.

What to include

Include every AI system with a material role in the business: customer-facing chatbots, internal productivity tools with AI features, AI used in HR or recruitment decisions, and any AI embedded in third-party software the organisation relies on. Err on the side of including a tool if you are unsure whether it counts as AI.

Finding shadow AI

Most organisations underestimate how much AI is already in use. Survey teams directly, check expense claims and software subscriptions for AI tools, and review what generative AI tools employees mention using informally. Shadow AI — tools adopted without formal sign-off — is usually the largest gap in a first inventory attempt.

What to record for each system

For each AI system: its name and purpose, the business owner, what data it processes, whether it makes or supports decisions about individuals, and its EU AI Act risk category (unacceptable, high, limited or minimal risk). This is the minimum needed to support both governance oversight and compliance obligations.

Keeping it current

An inventory that is accurate once and never updated quickly becomes misleading. Build a light review cadence — quarterly works for most SMEs — and make updating the inventory part of any new AI tool's rollout process, not an afterthought.

Frequently asked questions

What is the first step in building an AI inventory?

Identify every AI system in use, including shadow AI adopted by teams without formal sign-off.

Do I need special software to build an AI inventory?

No — a spreadsheet is sufficient to start; the free AI system inventory template covers the essential fields.

What is shadow AI?

AI tools adopted by individual teams or employees without formal procurement or governance sign-off.

What should be recorded for each AI system?

Name, purpose, owner, data processed, and EU AI Act risk category, at minimum.

How often should an AI inventory be updated?

At least quarterly, and whenever a new AI tool is introduced.

Related pages

Sources

Last updated 19 June 2026.