If you do not know which AI runs in the company, you can neither meet obligations nor steer risks. The AI inventory is therefore the first step of any AI governance and of any AI Act preparation.
What goes into it
Per system: name and vendor, purpose and area of use, user group, data processed with particular attention to personal data, place of processing, the company’s role as provider or deployer, risk class under the AI Act, applicable transparency obligations, responsible person, date of last review. For systems processing personal data, a reference to the record of processing activities belongs with it.
Finding shadow AI
The biggest gap is tools employees introduced themselves: chat assistants, translation and writing aids, browser extensions, AI features quietly switched on in existing software. A short survey of all teams, a look at spending and subscriptions and a check of features in CRM, office and HR software find most of them. The goal is not to ban them but to make them visible and decide deliberately.
Classifying
For each system, record whether it could fall under the prohibited practices, whether it is high-risk under Annex III, whether transparency obligations apply or whether it is minimally regulated. The reasoning belongs with it, especially where the company relies on an exception. That turns the list into a tool showing where action is needed.
Maintaining
An inventory goes stale quickly. It needs a responsible person, a trigger for new entries — such as approval of a new tool or the introduction of an AI feature in the product — and regular review. Linking the inventory to procurement and approval keeps it current with little effort.
What it is used for
The inventory is the basis for AI literacy measures under Art. 4, for implementing transparency obligations, for preparing for high-risk obligations, for data protection questions such as disclosures abroad and for the expectations of supervisors such as FINMA. The starting point is described in our 30-day AI Act readiness plan.