How to build a company AI inventory: four columns to start with

A company cannot choose proportionate measures without knowing which AI systems it uses. Article 4 does not mandate a form called an “inventory”, but the Commission recommends starting with the AI in use and its purpose.

The inventory is the starting point, not the final deliverable

The aim is not a list of brand names. Each use needs enough context to decide who needs guidance, which risk they should understand, and what evidence the company should retain.

Column 1: tool and purpose

Record the system, provider and specific task. “ChatGPT” says little. “Drafting sales proposals with human review” provides a context that can be assessed.

Column 2: people and role

Identify the teams using it, who reviews the output, and whether others operate it on the company’s behalf. Leadership, HR and support do not always need the same measure.

Column 3: context and possible effects

Record what may happen if the system is wrong or misused. Summarising a meeting differs from screening candidates, prioritising customers or replying to a person without review.

Column 4: measure, date and owner

Assign a concrete action: a use rule, guide, briefing, supervised review or targeted training. Add its owner, target date and the evidence it will leave.

• System and specific purpose.
• People using or supervising it.
• Context, risk and people affected.
• Measure, owner, date and evidence.

What it does not prove on its own

An inventory is not a compliance certificate or a substitute for legal assessment. It turns diffuse use into reviewable decisions and lets local counsel validate the points that need legal judgment.