You cannot comply with any AI rule if you do not know which AI systems your business is using. So this week's task is simple and universal: make a list. The EU AI Act does not have a single article that says "keep an AI register," but almost every obligation we have covered, from disclosure to risk classification to staff training, assumes you already know what AI you run and who uses it. An AI inventory is the foundation the rest of compliance is built on, and the good news is that a short, well-maintained list beats a giant one nobody updates.
Over the last two episodes we went deep into the obligations for high-risk AI systems. This week we come back up to ground level, because there is one step that comes before all of it, and that every business can do immediately regardless of risk tier: finding out which AI systems you actually use. It sounds obvious, but it is the single most common gap, and without it, none of the other rules can be met.
Why an inventory comes first
Here is the honest legal picture: the EU AI Act does not contain a single article that literally says "you must keep an internal AI register." But that is misleading on its own, because you cannot demonstrate compliance with almost any of its obligations without one. Think about what we have already covered. You cannot tell users they are talking to a chatbot (the disclosure rule) if you do not know which tools are AI. You cannot classify your systems by risk tier if you cannot see them all. You cannot train your staff on the AI they use (the AI literacy duty, in force since February 2025) without knowing which systems run and who uses them. In every case, the first step is the same: a complete view of your AI.
The biggest blind spot has a name: shadow AI. These are the AI tools your teams have quietly started using, a marketing assistant here, a transcription tool there, a chatbot a department signed up for, that no one centrally knows about. You cannot govern what you cannot see, and shadow AI is exactly what trips up otherwise careful businesses. And the risk is not abstract. A tool someone quietly adopted can turn out to be a banned practice, like the workplace emotion-recognition software from Episode 4, or an undisclosed high-risk system, and those carry fines of up to 35 million euros. The missing list is not what gets fined; it is the reason you never caught the tool that does. Your employees sign up, and the liability is yours.
If your organization has worked through data protection, you already know this move. An AI inventory is the AI equivalent of the GDPR record of processing activities, the register of how you handle personal data. That record is explicitly required under data protection law, and many organizations are now simply extending it with an AI dimension rather than starting from scratch. If you have that record, you are already halfway there; if you do not, the same discipline applies.
What to put in your inventory
An AI inventory does not need to be complicated, but each entry should answer the questions a regulator, a client, or your own team would ask. For every AI system you use, record a short set of facts.
| For each AI system, record | Why it matters |
|---|---|
| Name, description, and actual use | What it is and what you really use it for, not the brochure version. |
| Internal owner | A person in your organization responsible for it, not the vendor. |
| Your role under the Act | Are you the provider, deployer, importer, or distributor? (See Episode 5.) |
| Risk classification and reasoning | Which tier it falls in and why, including the Annex III category if high-risk. (See Episode 3.) |
| Vendor and contract status | Who supplies it, and what guarantees and documentation they provide. |
| Personal data and GDPR link | What personal data it touches, and the link to your data-protection records. |
| User groups | Who uses it, which also drives your staff-training duties. |
| Status and review date | Whether it is live, and when you last checked the entry. |
Keep it short and alive
Here is the most important piece of advice, and it is the opposite of what most people assume. Do not aim for completeness for its own sake. A short register that is reviewed regularly and actually drives decisions is worth far more than a huge, exhaustive one that nobody maintains and that is out of date within a month. The goal is not a perfect document; it is a living picture of your AI that you can trust when a question comes up. Start with the systems you know, add the ones you discover, and set a recurring date to review it.
Who needs to do this
Every business using AI, which now means almost every business, benefits from this, regardless of risk tier. If all your AI is low-risk, the inventory is still the thing that lets you prove that quickly and confidently if anyone asks. If some of it turns out to be high-risk, the inventory is what tells you that in the first place, so you can act before a regulator does. And it is increasingly practical, not just legal: tenders, procurement processes, and clients are starting to ask which AI systems you use and how you assessed them. A ready answer is becoming a competitive advantage.
Your action this week
Open a simple spreadsheet and start your AI inventory. List every AI system you know your business uses, then ask each team what tools they have adopted, this is how you surface shadow AI. For each system, fill in the fields above as far as you can, and do not worry about getting it perfect on the first pass. Then set a recurring reminder, quarterly is reasonable, to review and update it. That single list is the foundation every other rule in this series depends on, and building it is the highest-value compliance step most businesses can take today. Next week, we look at a question many businesses outside Europe wrongly assume does not apply to them: whether the EU AI Act reaches your business even if you are not in the EU.
Frequently asked questions
Does the EU AI Act require an AI inventory or register?
Not in so many words, there is no article that literally orders you to keep an internal AI register. But in practice you cannot demonstrate compliance with almost any obligation without one, from the transparency and disclosure rules to risk classification and staff training. An inventory is the practical foundation the rest of the Act's requirements rest on.
What is shadow AI, and why does it matter?
Shadow AI is the AI tools your teams start using without central oversight, a writing assistant, a transcription service, a chatbot a department signed up for. It matters because you cannot govern, classify, or disclose what you do not know exists, and shadow AI is the most common blind spot that undermines otherwise careful compliance. Surfacing it is a key reason to build an inventory.
What should an AI inventory contain?
For each system: its name, description, and real use; an internal owner; your role under the Act (provider, deployer, importer, distributor); its risk classification and the reasoning; the vendor and contract status; what personal data it touches and the link to your GDPR records; who uses it; and its status with a review date. Keep each entry short and useful rather than exhaustive.
Is this the same as our GDPR records?
It is closely related. An AI inventory is the AI equivalent of the GDPR record of processing activities, which data-protection law explicitly requires. Many organizations extend that existing record with an AI dimension rather than building a separate one. If you already maintain GDPR records, you have a strong head start.
We only use low-risk AI. Do we still need this?
Yes, and it is easier for you. If all your AI is low-risk, the inventory is what lets you show that quickly and confidently if a regulator, client, or tender asks. It also catches the moment a new tool pushes you into a higher-risk category. A short, maintained list is low effort and high value regardless of your risk tier.
Follow the series, get compliant one rule at a time
This is Part 7 of our weekly guide to AI regulation, breaking down one rule at a time so compliance feels manageable instead of overwhelming. Explore more clear, honest guides on AISetApp and follow along each week.
Explore more on AISetApp- EU AI Act (Regulation (EU) 2024/1689), Article 4 (AI literacy, in force since February 2, 2025), Article 50 (transparency), and Articles 49 and 71 (registration of high-risk systems)
- 2026 analyses on whether an AI inventory or register is required under the EU AI Act, and the parallel with the GDPR record of processing activities (Article 30), from aiactblog.nl and EU AI Act compliance guides
- Practitioner compliance checklists on AI system inventories, shadow AI, and risk classification, 2026
Reviewed October 2026. This is an explainer, not legal advice. The law is evolving; verify specifics with a qualified professional before acting.
Researched and drafted with AI assistance, reviewed and edited by Yasser El Hardouz, who takes editorial responsibility for this article.