Building your AI inventory

The answer in thirty seconds

No article requires you to keep an ‘AI inventory’ if you simply use everyday tools. So it is not an obligation — it is the only document that lets you know what you have, spot the day a use tips into high-risk, and prove, if you are asked, that you took things seriously. A spreadsheet is enough.

The seven columns that are enough

• The tool — its name, its version, its vendor.
• What it is for — in one sentence, in the words of the business, not those of IT.
• Who uses it — the department, and the number of people.
• The data it receives — and above all: does it hold personal or confidential data?
• Your role — deployer, provider, importer.
• The level of human oversight — is the decision reviewed by someone, and by whom?
• The person responsible — a name, not a department.

Add an eighth column if you want to save time later: the date of the last review. The downloadable template has nine — it also names the person responsible, because an inventory with no name against each tool helps nobody.

The invisible uses, which are the real subject

An inventory that lists only the tools bought by management is a false inventory. In almost every company, AI has come in through three doors nobody officially opened:

• Personal accounts — a colleague uses their own subscription to a generative assistant to work faster.
• Features added to software you already had: automatic summaries in email, transcription in the video conferencing tool, suggestions in the word processor.
• Free tools found on the web for a one-off task — editing an image, translating a contract, generating a text.

The right method is not a questionnaire, it is a twenty-minute conversation per department, with one simple question: ‘what has been saving you time these past six months?’. The answers never appear on any invoice.

A real example

A thirty-person small business thought it had two AI tools. After a round of the departments: a generative assistant used by half the office on personal accounts, automatic meeting transcription switched on by default, a photo editing tool in marketing, a scoring module in the sales software, and automatic screening of applications in the recruitment tool. Five uses, one of them high-risk. Not one was documented.

What you can do tomorrow

• Create the table and fill it in for three tools only — starting small beats never starting.
• Do the round of the departments with the time-saving question.
• Appoint one person as responsible, just one, and write down the date of the next review.

Common mistakes

Confusing it with the GDPR record. These are two different documents: one lists processing of personal data, the other AI systems. They often overlap, they never replace each other.

Doing it once. An inventory that is not reviewed ages in three months — that is the rate at which vendors add AI features to software you already use.

Leaving it to IT alone. The IT department knows the licences, not the uses. It is the business teams who know.

Reference sources

Going further

This page is based on the consolidated text of Regulation (EU) 2024/1689 in its version of 27 July 2026. Verified 26 August 2026. General information: it does not constitute individual legal advice.