Step 1
Inventory the AI you use, including what arrived without a contract
By the end of this step you will have the first dated version of your inventory: each AI system, what it does, who answers for it and what data it touches.
What this step is
An AI inventory is the list of the AI systems your organisation uses, one per distinct AI function, including those that live inside a larger piece of software. It is not a list of brands: “the CRM” is not a row; “the CRM assistant that drafts replies to customers” is.
The hard part is not writing down what you bought. It is finding what came in without a purchasing decision: the feature a vendor switched on in an update, the assistant someone on the team started using with a personal account, the filter that came inside a service contracted for something else. That AI without a contract of its own goes in the inventory too, because it is used all the same.
This step produces a first version, not the final one. A reasonable inventory in a week is worth more than a perfect one that never closes, as long as the document itself says which sources were reviewed and which are still pending.
Why
Regulation (EU) 2024/1689 does not require you to keep an inventory of AI systems as such: it is an internal methodological control, not a legal obligation. But it is the precondition for almost everything that does bind you, because the obligations are written system by system. Whoever deploys a high-risk system must use it in accordance with its instructions for use and assign its human oversight to specific persons; Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach products under Section B of Annex I. None of those obligations can be met on an estate you do not know.
The same holds for what applies earlier. The prohibited practices of Article 5 have applied since 2 February 2025 (the two added by Regulation (EU) 2026/1744, from 2 December 2026), and the transparency obligations of Article 50 apply from 2 August 2026 (for the marking under paragraph 2, Article 111(4) sets 2 December 2026 as the deadline for providers of systems placed on the market before that date). To know whether any of them reaches you, you first need to know which systems you use and for what.
There is one register that is mandatory, and it should not be confused with this one. The GDPR requires each controller to maintain a record of processing activities (Article 30(1)), with the exceptions in its paragraph 5. Its subject is the processing of personal data, not AI systems. The two meet when a system processes personal data, which is why the inventory records what data each system touches: it is the bridge between the two registers.
How, in three actions
Sweep four sources, not one
Go through software invoices and subscriptions for the last twelve months; the admin console of your main tools —office suite, CRM, ERP, management software— looking for AI features that are switched on; those vendors’ release notes; and a short question to each head of area: which AI-enabled tools does their team use, even free ones or on personal accounts. Note which source each row comes from.
One row per function, with just enough
For each system: name, provider, what it is used for in concrete terms —“summarising patient records”, not “productivity”—, department, who answers for it, since when it has been in use, whether it processes personal data and of what kind, and whether it makes decisions or recommendations about people. For organisations in Spain, also note whether it decides on staff working conditions. Leave one empty column for the role (step 2) and another for the risk level (step 3).
Date the version and decide what reopens it
Close the first version with a date, an author and the list of sources reviewed. Write down what reopens it: a new tool, an update that adds AI features, a change of use. Ask for the person appointed in step 0 to be told before any AI-enabled tool is switched on. A system you stop using is marked as inactive, not deleted: its history is evidence too.
The typical mistake
Inventorying only what was bought with an “AI” label.
Much of an SME’s AI did not arrive under that name: it comes inside email, the CRM, the booking software or the recruitment tool. An inventory built from purchasing alone comes up short, and it comes up short exactly where it matters most: a candidate-screening feature hidden inside a recruitment service weighs more than ten writing assistants. You avoid it by sweeping all four sources and asking about functions, not products.
The template
The template has thirteen columns per system —provider, purpose, area, owner, registration date, data processing, your company’s role and a preliminary risk reading, among others— and the definition of “AI system” in Article 3, point 1, of Regulation (EU) 2024/1689, to decide what goes on the list.
AI systems inventoryEstimated time
A first version in one week, between days 1 and 10 of the Route: a few hours of your own sweeping, and the rest of the time waiting for each area to reply.
What you take away
The AI systems inventory, version 1, with a date, an author and the list of sources reviewed and pending.
How it works in Alethexis
In Alethexis, each system is recorded in a two-step form: first name, provider, purpose and department; then your role, the personal data it processes and its categories, and notes, and on each row you mark its capabilities —generates text, chats with people, makes decisions or recommendations about people, screens candidates—.
The “Sector examples” panel shows systems common in your sector and “Use as a starting point” fills in the form with one of them; a system you stop using is marked as inactive so its history is kept, and the section is only completed when you press “Finalise section”.
Further reading
- Shadow AI: why the inventory is the foundation of everything
- The AI Act doesn't require you to keep an inventory. It's the precondition for almost everything that does
- The AI inventory in a spreadsheet: why it stops working, and it's not about the number of rows
- AI use requests: somewhere to ask before using a tool