control
AI inventory
A register of the AI tools and uses in your company, with an owner, a purpose, the data involved and the rules for each. No text requires the register itself. Without it you cannot tell which AI Act duties apply to you.
- what it protects
- you know which AI tools see your data, so the right duties and training attach to them
- who owns it
- head of IT, with the board naming who owns AI use
- start with
- ask each team lead what their people use and write one row per tool with one owner
what it is
An AI inventory is a register of every AI tool and use in the company. For each one it says who owns it, what it is for, what data goes in and what the rules are. It covers paid assistants, AI features inside software you already run, and tools staff use on their own.
No text read for this page requires the register itself. The AI Act asks for AI literacy measures for staff who use these systems, and for further duties if a use is on the high-risk list. You cannot say which of those applies, or train people on the right tools, without knowing what is in use. That is why the register is practice and the first step for the rest.
Start with a short, honest list and sort it by use. Most entries will be ordinary office help. A few, such as tools that filter applicants or evaluate staff, carry the duties that start from 2 December 2027. Name an owner for each entry, then review the list on a schedule.
basis AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1; AI Act Art. 26(1); NIS2 Art. 21(2)(d); GDPR Art. 32(1). The register itself, its fields and the review rhythm are practice.
how an AI register stays true
- 1findask teams and look for tools nobody reported
- 2recordowner, purpose, data and rules for each entry
- 3sortordinary office help or a use that needs more duties
- 4reviewa date for each entry and a way to add a tool
where tools hide from a register
- bought on a carda team signs up without telling IT
- switched on in an updatesoftware you run adds an assistant
- free toolsstaff paste work into them on their own
- browser extensionsinstalled one by one, seen by no list
basis working practice. No legal text sets this.
an example
Picture a company of 200 people where a few teams started using AI tools last year.
The policy lists two approved assistants. Sales pastes customer emails into a free tool, the recruiter uses a screening feature that came with an update, and nobody has written any of it down. When a customer asks where its data went, no one can answer.
A register lists every tool in use with an owner, its purpose, the data that goes in and the supplier's terms. The recruiting feature is marked as a use that needs more care. Anyone can add a tool through a short form and gets an answer quickly.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| AI Act | AI Act Art. 4 | Providers and deployers take measures to support the AI literacy of the staff who use AI systems. The wording was replaced by Regulation 2026/1744, which does not require a set level for each person. | List the tools staff actually use, so the training covers the tools in use. |
| AI Act | AI Act Art. 26(1) | A deployer of a high-risk system uses it according to the provider's instructions. Further deployer duties cover oversight, monitoring, logs and informing workers. | Mark in the register which uses touch applicants, staff or other high-risk areas, and keep the provider's instructions with that entry. These duties start from 2 December 2027. |
| NIS2 | NIS2 Art. 21(2)(d) | Supply chain security, including relationships with direct suppliers and service providers. | Treat each AI service as a supplier: record who runs it, where your data goes and what the contract says. |
| GDPR | GDPR Art. 32(1) | Appropriate technical and organisational measures for personal data, sized to risk. | Record which data each tool receives, so personal data is not pasted into a tool that was never checked for it. |
basis AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1; AI Act Art. 26(1); NIS2 Art. 21(2)(d); GDPR Art. 32(1). None of these requires an inventory. The register is practice.
what to look for when you choose
- Does the register hold, for each entry, a named owner, the purpose, the data that goes in and the rules for use?
- Does it cover tools bought by a team on a card, AI features switched on inside software you already run, and free tools staff use on their own?
- Is there a way to find tools nobody reported, such as a review of expense claims, sign-in logs or browser extensions?
- Does it mark which uses involve personal data, applicants or staff?
- Does it record what the provider's terms say about using your inputs to train its models, and about where data is kept?
- Who approves a new tool, and how fast, so people do not route around the process?
- Is there a review date for each entry and a rule for removing a tool?
- Does the register link to the training, so each rule in it is something staff were told?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Ask every team what they use and write a first list with one owner per row.
- solid
Add purpose, data and supplier terms, mark uses that touch personal data, applicants or staff, and review the list every quarter.
- strong
Look for unreported tools in expense claims, sign-in logs and extensions, set a fast approval path and link each rule to the training.
basis working practice. No legal text sets this.
where it goes wrong
a register of approved tools only
Staff already use tools nobody approved. A register that lists only the sanctioned ones shows the policy and hides what happens. Record what is in use, then decide.
no owner on an entry
An entry with no named person is not reviewed and not answered for. Give every row one owner.
ignoring AI inside other software
Many products add an assistant feature in an update. Check what your existing suppliers have switched on, and ask whether you can turn it off.
treating every use as high-risk
Most office uses are not on the high-risk list. Sorting entries by use keeps the heavy duties for the few that need them, for example tools that filter applicants or evaluate staff.
one-time listing
A list made in a workshop is out of date within a quarter. Set a review date and a way for people to add a tool.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| the AI register: tool, owner, purpose, data, rules, review date | head of IT, with the board naming who owns AI use | quarterly |
| the record of your check of the tools against the banned practices | head of IT or legal | when a tool is added |
| the training record that covers the tools on the register | head of HR | yearly |
| provider instructions and oversight assignments for any high-risk use | business owner of that use | yearly |
basis practice. The rhythms are your choice.
check it yourself
your next step
Ask each team lead which AI tools their people use, and write the answers into a first list with one owner per row.