AI inventory template for AI tools and use cases
For operations, IT, privacy, security, and AI owners bringing scattered generative-AI use into one reviewable record.
Capture the facts that make an AI register useful: what the system is, why it is used, who owns it, what data it touches, and what needs review next.
An inventory makes facts easier to discuss. Listing a system does not classify it, prove compliance, or turn this page into an EU-mandated form.
A reviewable starting point
- Start from how your organisation actually uses AI.
- Name the owner, evidence, and open question for each record.
- Keep the next review visible as tools and guidance change.
What to capture
Fields that make a register useful
The goal is a living record that can answer the next operational question without asking a team to reconstruct its AI use from memory.
- 01
System and purpose
Record the tool, model, embedded feature, or internal system and the business activity or use case it supports.
- 02
Owner, vendor, and account
Name the accountable internal owner and capture the vendor, account, supplier relationship, or technical contact needed for review.
- 03
Data categories
Describe the information entered, generated, or exposed, including sensitive or confidential categories that change the review questions.
- 04
Human oversight
State where a person checks outputs, approves an action, handles exceptions, or remains accountable for a decision.
- 05
Status and evidence
Track whether the record is proposed, active, paused, or under review, with links to policy, approval, vendor, testing, or literacy evidence.
- 06
Next review and open questions
Give the record a review date and a short list of missing facts or decisions so it keeps moving instead of becoming a forgotten spreadsheet row.
Practical workflow
From scattered use to a living record
A register becomes valuable when it reflects real use, has an accountable owner, and creates the next review action.
- 01
Discover
Look for approved tools, procurement records, team workflows, product features, and shadow or embedded AI use. Ask what is actually happening today.
- 02
Assign ownership
Give each system or use case an owner who can answer questions, gather evidence, and coordinate a review with privacy, security, legal, or operations as needed.
- 03
Review evidence and cadence
Fill the important gaps, connect the record to policy and controls, and set a next review date that reflects how quickly the tool or use case can change.
Scope and sources
A register is evidence to review, not a legal answer
ProofCairn provides operational governance support, not legal advice or a definitive legal classification. Applicability depends on your role, system, use case, jurisdiction, and current guidance; professional review may be needed. The AI Act does not prescribe one universal inventory template, and recording a system does not by itself prove compliance or classify that system.
Questions worth asking
Keep uncertainty visible.
Is this an EU-mandated AI inventory form?
No. It is a practical set of fields for organising an organisation’s facts and questions. Adapt it to your context and check current Commission guidance and the legal text before relying on it for a governance decision.
Does listing an AI system prove compliance?
No. An inventory is a useful governance record, but it does not replace the controls, evidence, review, or qualified assessment that a particular role, system, or use case may require.
Can this template classify my AI system?
No. Classification depends on the facts, role, intended purpose, use, jurisdiction, and current interpretation. Use the inventory to prepare those facts for an appropriate review rather than treating a field value as a legal conclusion.
Five minutes to a clearer next step
Start with the free AI Governance Readiness Check.
Answer ten practical questions about how your organisation uses generative AI and get a prioritised operational signal.
Not legal advice, not a compliance test, and not a definitive legal classification.