An AI inventory is a documented, up-to-date list of every AI system a business uses — who uses it, what it does, and what data it touches — kept in one place instead of scattered across whoever happens to know about it. It's the foundation of AI governance: you cannot assess risk, prove compliance, or respond to a regulator's question about a specific tool if you don't first know the tool exists.
Why an AI inventory matters now
The EU AI Act doesn't regulate "AI" as one thing — it regulates specific systems differently depending on what they do. A CV-screening tool sits in a different risk category (Annex III, high-risk) than a marketing copy generator. A customer-facing chatbot has its own separate disclosure duty (Article 50). You can only know which rules apply to which tool if you have a list of your tools in the first place.
Most businesses don't have that list. AI shows up piecemeal — someone turns on a Copilot feature in Microsoft 365, a vendor quietly ships an "AI-powered" upgrade to the helpdesk tool you've used for years, a manager signs up for a CV-screening add-on without looping in anyone else. None of that shows up in a procurement system built for buying software, because nobody "bought" a new product — the AI just appeared inside something already installed.
What belongs in an AI inventory
The test isn't "does it have AI in the name." The EU AI Act's own definition (Article 3(1)) is a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions. In practice, that covers categories like:
- Chat assistants & writing tools — General-purpose AI your staff use day to day. Examples: ChatGPT, Microsoft 365 Copilot, Google Gemini, Claude, Grammarly.
- Customer-facing chatbots & voice bots — Anything that talks to customers on your behalf. Examples: Website chat widget, Intercom Fin, Zendesk AI agents, AI phone / voice agent.
- AI features inside software you already use — The easiest ones to miss — AI switched on inside a tool you bought for something else. Examples: Salesforce Einstein, HubSpot AI, Notion AI, Zoom AI Companion, Canva Magic Studio.
- Hiring & HR — Screening, ranking, or evaluating candidates and employees. Examples: CV / résumé screening, Video-interview analysis, Candidate ranking in your ATS, Performance analytics.Recruitment and worker evaluation are listed as high-risk use cases in EU AI Act Annex III, point 4.
- Finance, credit & risk — Scoring, pricing, or approving things for people. Examples: Credit scoring, Loan or BNPL approval, Fraud detection, Invoice / expense extraction.Creditworthiness and credit scoring of individuals is an Annex III high-risk use case (point 5(b)); fraud detection is expressly excluded from it.
- Marketing & generated content — AI that writes, draws, or personalises for you. Examples: Image generators (Midjourney, DALL·E), AI copywriting, Product recommendations, Ad targeting.
- Coding & internal tools — Developer assistants and anything your team built. Examples: GitHub Copilot, Cursor, An LLM API call inside your own product, In-house ML models.
What doesn't belong: plain automation that only follows rules a person wrote — email filters and rules you wrote yourself, zapier / make workflows with fixed if-this-then-that steps, spreadsheet formulas and macros, plain keyword search. If a human wrote every branch of the logic, it's automation, not AI, and it's out of scope.
How to build one
- List every department that could plausibly use AI — support, HR, marketing, sales, engineering — and ask each one directly, rather than relying on IT's software list alone.
- For each tool, record what it does, who uses it, and what data it processes (customer data, employee data, or neither).
- Flag anything that touches hiring, credit, or biometric data for closer review — these are the categories most likely to be high-risk under Article Act frameworks like the EU AI Act's Annex III.
- Assign an owner and a recurring review date — quarterly is a reasonable default — since vendors add AI features to existing tools without announcing it.
- Score each tool against the specific legal requirements that apply to it, rather than treating the inventory as a static list with no verdict attached.
Frequently asked questions
Is a spreadsheet good enough for an AI inventory?
It can be a starting point, but it usually goes stale fast — nobody updates it when a new AI feature gets switched on inside a tool they already use. A working inventory needs an owner, a review cadence, and ideally scoring against the actual legal requirements that apply, not just a list of names.
Who should own the AI inventory in a small business?
Whoever is closest to where AI tools get adopted — often an ops or HR lead, not necessarily IT. The person filling it in doesn't need to be technical; they need to know what the business actually uses day to day.
How often should an AI inventory be updated?
Whenever a new AI tool is adopted, and at minimum every quarter to catch AI features that vendors silently switched on inside tools you already pay for.
Build yours with DiscloseAI
DiscloseAI's free guided assessment walks you through building an AI inventory tool by tool, then scores each one against the EU AI Act automatically — no spreadsheet, no guessing which requirements apply. Free EU AI Act check →