AI inventory: the first step for the AI Act, in 2 minutes

Before you ask whether your business complies with the AI Act, there is a simpler question that almost nobody can answer: which AI tools do we use, who uses them and what for?

The regulation makes distinctions by role, by risk level and by type of use ¹. Until you have the list, any reasoning about obligations and deadlines is up in the air. This article shows how to build it in two minutes, and explains the sixteen columns with a few more details.

One row for every use, not for every tool

The rule that avoids half the mistakes: if the same tool serves two departments for different things, that is two rows. ChatGPT writing marketing drafts and ChatGPT sorting CVs carry different risks, even if there is only one subscription.

Don't fill it in on your own. Send it to the heads of department and ask them to include the tools switched on by individuals too: personal accounts, browser extensions, apps on their phones. These are the ones nobody has authorised, and they usually weigh the most.

The first five columns say what

Tool, provider, licence type, who uses it, what for. It looks like basic record-keeping, but the third column is already a decision. With a business licence the big providers state that they do not use your data to train their models, while with a personal account they often do: we covered this in Do ChatGPT, Claude and Gemini use your business's data?.

Then two columns on data: which data goes into the tool and whether the output leaves the business. A text that ends up with a customer, on the website or on social media deserves more attention than a summary only you read.

Then the AI Act comes in

Role. Almost always your business is a deployer, meaning it uses an AI system made by others under its own authority ¹. The deployer's duties are in this guide to Article 26.

Risk level. The template has a second sheet, "Risk guide", that works as a compass. In short:

• Minimal: writing, translation, internal analysis, summaries. This is most uses in an SMB.
• Transparency: chatbots that talk to customers and realistic generated content. The obligations apply from 2 August 2026 ²: the chatbot identifies itself, the content is labelled. Details in the guide to Article 50.
• High risk: recruitment and staff evaluation, access to credit, assessments in education. For these uses the obligations start on 2 December 2027 ². The full list is in Annex III.
• Prohibited: manipulating people, social scoring, emotion recognition at work. Illegal since 2 February 2025 ^{1, 2}, so stop using it straight away.

If a case isn't clear to you, write "to be checked" and pass it to your lawyer. An honest box is better than an invented classification.

The last columns say who is accountable

Who checks the output before it is used. Who has been trained, when and on what: the obligation to train the people who use AI has applied since 2 February 2025 ^{1, 2}, and the guide to Article 4 explains what is really enough. What the contract with the provider says about training and data residency. Whether the notice to workers required by the Italian AI law (Law 132/2025) is needed ³. And who the internal owner is.

The last column is the most useful: the next action, with a deadline. "Move to the business licence by November" is an inventory that works. Without this column you only have a snapshot.

How to keep it alive

Update it every three months and whenever a new tool arrives. An inventory filled in once and forgotten is worse than no inventory, because it gives you a confidence you don't have.

You don't need software. You need a shared sheet, an owner and the discipline to reopen it. When the departments become many, it is worth having a page where everyone fills in their own part and the register updates itself.