From “we really should” to “it’s done”.

AI system inventory template

The document that lets you know what you have. No article imposes it on businesses that simply use off-the-shelf tools — but it is the only way to spot the day a use tips over into high-risk, and the simplest evidence of the measures you are taking under Article 4.

Download the template (.csv file, opens in Excel or LibreOffice) →

The nine columns, and why each one is there

• Tool and version — two versions of the same software do not have the same AI features.
• Provider — this is who you will ask for documentation when the day comes.
• What it is for — in one sentence, in the words of the job.
• Who uses it — the department, and how many people.
• Data processed — the only question that matters: is there any personal or confidential data?
• Your role — deployer, provider or importer. If in doubt, read the guide “Does this apply to my business?”.
• Human oversight — who reviews, and at what point. This is the column that protects you most.
• Person responsible — a name, not a department.
• Date of the last review — an inventory that is never reviewed goes stale in three months.

Start with three tools. An incomplete inventory is worth infinitely more than one you never started.

Transparency checklist

To go through once, then again for every new piece of content or new tool that the public sees. These obligations have applied since 2 August 2026.

Your chatbots and assistants

• Does the person know they are talking to a machine before the first exchange?
• Is the notice visible on screen, rather than buried in the terms and conditions?
• Is a way of reaching a human given?
• If your assistant is supplied by a third party: is the notice there by default, or do you have to add it yourself?

Your published content

• Are generated images, audio and video showing people, places or events that could pass for real flagged as artificial?
• Do AI-generated texts published to inform the public on a matter of public interest carry a notice — or the name of an identified human reviewer?
• Content you published before 2 August 2026: nothing to do, there is no retroactivity.

Your generative tools

• Does your provider apply machine-readable marking to what its tool produces?
• If its system was already on the market before 2 August 2026, where does it stand on the 2 December 2026 deadline?
• Has it signed the Code of Practice on the transparency of AI-generated content? This is not mandatory, but it makes compliance easier to demonstrate.

Wording ready to paste

• Chatbot: “You are talking to an automated assistant. To speak to a person, write to …”
• Generated image: “Image generated by artificial intelligence.”
• Article: “This text was written with the help of artificial intelligence and reviewed by [first name last name], responsible for publication.”

Provider questionnaire: the questions to ask before you sign

To be sent in writing to any publisher of an AI tool you are considering. The answer — or the silence — will tell you as much as the product does.

About the system itself

• Do you consider your system to be high-risk within the meaning of Annex III or Annex I of the regulation? On what basis?
• How far along is your compliance work, and on what timetable?
• Can you supply your technical documentation and your instructions for use?
• Does your system produce synthetic content? Is it marked in a machine-readable way?

About the data

• Is our data used to train your models? How do we switch that off?
• Where is it hosted, and does it leave the European Economic Area?
• How long is it kept, and how do we have it deleted?
• Do you offer a processor agreement that complies with the GDPR?

About liability

• What happens if your system produces a wrong decision that causes us harm?
• Do you inform us of serious incidents, and within what time?
• If we distribute your tool under our own brand, who is the provider within the meaning of the regulation?

This last point is decisive: putting your name on an AI tool can make you its provider, with all the obligations that go with that.

AI literacy plan: half a day, not a training programme

Since the Digital Omnibus, Article 4 requires you to “take measures to promote the development” of AI literacy — with no obligation to guarantee a given level. Here are measures that are proportionate, realistic for a small business, and can be documented.

1. A one-page set of internal rules

• The tools that are allowed, and those that are not.
• What never goes into them: client or employee data, health data, trade secrets, source code, documents from an ongoing case.
• What has to be reviewed by a human before it leaves the company, and by whom.
• What has to be flagged as AI-generated.
• Who to call if in doubt — a name.

2. A thirty-minute meeting

Present the page, show two real examples — one good use, one to avoid — and answer questions. It works better than an online module nobody finishes.

3. A written record

Date, attendees, the material handed out. Three lines in a file are enough: that is the evidence the measures were taken.

4. A review every six months

Tools change, and AI features appear in software you already had. Go back over the inventory, update the rules page, and say it again in a meeting.

What this plan is not: a certification, an exam, or a training budget. The obligation is a best-efforts obligation — these four measures meet it.

Tools checked on 26 August 2026 against the consolidated text of Regulation (EU) 2024/1689. General information, not individual legal advice.