Know which AI you use
Know which AI your organisation uses, what for and with which data, in a single record that stays up to date.
The inventory records every AI system your organisation uses: one per distinct AI function, including those that live inside a larger piece of software. It is the cornerstone of the product: without an inventory there is no classification, no controls and no assessments.
It is also your tool against shadow AI —systems in use without management knowing—: what you declared at sign-up gives you a starting list so that none is left out.
Risk classification, provider due diligence and the M2 and M3 modules all work on the systems you record here. That is why the inventory is never fully closed: it is a living record that stays editable and goes back to “In progress” when you add a new system.
First the basic details (name, provider, purpose, department), then the detail (your role, personal data, whether it is an agent, notes). The purpose is described in concrete terms —“analysis of panoramic X-rays”, not “diagnosis”— because it steers the later classification. The provider can be linked to its record in provider due diligence.
For each system you state whether your organisation uses it under its authority (deployer), places it on the market or puts it into service under its own name or trademark (provider) or both; most SMEs are deployers. You mark whether it processes personal data and which categories: identification, health, biometric, financial… If the system acts autonomously, you mark it as an agent and it is managed in the Agentic module.
While you fill in the form, the “Sector examples” panel shows systems common in your sector. With “Use as a starting point”, the form is filled in with the example and you change whatever does not fit your case. They are a guide: record the ones you actually use, whatever they are called.
On each row you mark its capabilities: generates text, generates images, audio or video, chats with people, makes decisions or recommendations about people, builds profiles, acts autonomously, screens candidates… It is your own record: it does not classify anything by itself. If you change a capability after classifying, that system's classification goes into review.
A system you stop using is marked as inactive instead of being deleted, so its history is kept; the filter switches between active systems only and all of them. The inventory records which systems make decisions about your staff's working conditions (Real Decreto 723/2026, organisations in Spain). The Owner, the AI Officer and Contributors record and edit systems; only the Owner deletes them.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
For each system, document: name, provider, declared intended purpose, user department, deployment date, and active or retired status. Without these fields no classification or evidence workflow can run.
Determine, for each system, whether the organisation acts as deployer, provider or both (Articles 3(3) and 3(4)). The assessment governs which obligations apply and is persisted in the inventory for all subsequent workflows.
Legal basis
No direct basis in law.
Identify and record every AI system in use across the organisation, including SaaS, APIs, copilots, plugins and models embedded in vertical applications. It is the basis of all subsequent governance and a precondition for risk classification (VIS-2).
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.