AI Tool Inventory: Build One for Your Business in an Hour
Create a practical inventory of the AI tools your business uses, who owns them and what data they handle, with a 10-field template and a 60-minute plan.
👁 114 reads
An AI tool inventory is a single list of the AI tools your business uses, who is responsible for them and what kinds of data they handle. The AI Act does not explicitly require businesses that use off-the-shelf chatbots and assistants to keep one, but an inventory can help you understand how AI is used across your organisation and where you may need policies, training or further review. Here are 10 useful fields, example entries and a plan for putting together a first version in an hour.
AI tool inventory: at a glance
An inventory can provide a foundation for other documents and processes. It can help you shape an AI policy, plan training around the tools your organisation actually uses (Article 4 of the AI Act), identify where transparency requirements may apply (Article 50) and flag prohibited practices (Article 5). A spreadsheet with 10 columns, a named owner and a review date is a practical starting point. Keep it in a location your team can access when needed.
Why your business needs an AI tool inventory
Many businesses do not know how many AI tools they use. A chatbot is only the beginning - AI may also be built into office software, a CRM, a translation tool, a design program or a recruitment system. An inventory helps you keep track of four things:
- AI literacy (Article 4). The Act says providers and deployers must take measures to ensure a sufficient level of AI literacy, taking account of the context in which systems are used. An inventory can make training more relevant than a generic overview. See the European Commission’s AI literacy questions and answers.
- Transparency (Article 50). An inventory can show which tools generate images, video or audio for publication, and where a chatbot interacts with customers.
- Prohibited practices (Article 5). An entry for a tool that analyses employees’ emotions, for example, gives you a reason to investigate whether its use is prohibited.
- High-risk AI (Article 6 and Annex III). AI used in recruitment, credit scoring or education may require further assessment. The relevant application dates depend on the AI Act’s rules and amendments.
10 fields to include in your AI tool inventory
| Field | What to enter | Example |
|---|---|---|
| 1. Tool and version | Name and plan; business or personal account | ChatGPT, business plan |
| 2. Provider | Company that provides the tool | OpenAI |
| 3. Department | Who uses it | Marketing |
| 4. Use case | The specific task, not “various” | Drafting posts and translations |
| 5. Owner | Role responsible for the tool | Marketing manager |
| 6. Data categories | Types of data, not the data itself | Public content; no customer data |
| 7. Your organisation’s role | Provider or deployer (Article 3, points 3-4) | Deployer |
| 8. Risk | Prohibited, high-risk, transparency or minimal risk | Transparency (images for publication) |
| 9. Rules and training | Reference to the relevant policy and training | Policy v1; training, October 2026 |
| 10. Review date | When the entry was last checked | 13 October 2026 |
Do not put passwords, API keys or customer documents in your inventory. It should point to the relevant decisions and identify who is responsible, not replace your provider’s documentation.
Build your first inventory in an hour
Your first version does not have to be perfect. Here is a 60-minute plan for a business with up to a few dozen people:
- Collect a list (20 min). Ask each department one question: “Which AI tools or features do you use at work, even if only once a month?” Give examples such as an office-suite assistant, a translation tool, an image generator or AI features in a CRM. Ask people not to include confidential examples.
- Merge duplicates (10 min). “ChatGPT” listed by five people might mean five different accounts. Separate entries by version, such as a business account covered by an agreement and a personal account.
- Record data and role (10 min). For each entry, note what categories of data go into the tool and whether your organisation simply uses it or provides it under its own name.
- Assess risk (10 min). Flag tools that generate content for publication (Article 50), concern candidates or employees (potentially high-risk) or should not be used at all (Article 5).
- Assign owners and dates (5 min). Assign a responsible role to every tool.
- Save a version (5 min). Save the file with a version number and date in a location you can access remotely.
Example AI tool inventory entries
These three fictional entries for a small agency show the level of detail to aim for:
| Tool | Use and data | Risk and rules |
|---|---|---|
| AI chatbot, business plan (marketing) | Drafting posts and translations; public content, no customer data | Transparency for content about matters of public interest; policy sections 4-6 |
| Image generator (marketing) | Campaign illustrations; no personal data | Article 50(4) for realistic images of people and places; label at publication |
| Website chatbot (customer service) | Answers questions about products and services; customer’s name and email | Article 50(1) - tell users at the start of the conversation; data-processing agreement |
Common AI inventory mistakes
- Listing chatbots only. You may miss AI features in software your business bought for another purpose.
- Treating a declaration as approval. A tool appearing in an employee’s response does not mean its use has been approved. Consider adding an “approved: yes/no” column.
- Putting personal data in the inventory. Record a category, such as “customer contact details,” not information about specific people.
- Leaving out the review date. Tools and features change every few months. Without a review date, an inventory may be out of date within six months.
- Keeping the inventory in a drawer. A list the team does not know about cannot support training. Refer to it in your AI use policy.
Frequently asked questions
Is an AI tool inventory mandatory?
The AI Act does not explicitly require businesses that only use off-the-shelf tools to keep an inventory. It is a practical way to understand what your organisation uses and support measures to promote AI literacy under Article 4.
How is an internal AI inventory different from the EU database of high-risk AI systems?
The EU database under Articles 49 and 71 of the AI Act concerns the registration of certain high-risk AI systems by providers and some deployers. An internal AI tool inventory is a business document maintained for your own oversight.
What format should you use?
A spreadsheet or CSV file is enough. Give it a version number and date, and keep it somewhere your team can access when needed.
How often should you update the inventory?
Update it whenever you add a new tool and at least every 6-12 months. Refreshing it when you update staff training is a good opportunity.
Who should maintain the inventory?
Assign it to one person or role, such as an operations manager or someone in IT. Departments can report changes, and the inventory owner can review and approve them.
This is not legal advice. If you are unsure whether an AI system is high-risk, seek advice from a qualified professional.
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex - Articles 3, 4, 5, 6, 49 and 50; Annex III
- Regulation (EU) 2026/1744 (Digital Omnibus) - revised wording of Article 4 and high-risk application dates
- European Commission: AI literacy - questions and answers
Legal status checked on 1 October 2026; links checked on 13 October 2026.
