EU AI Act AI System Inventory Template XLSX
Professional Excel worksheet with Start Here, Dashboard, AI system inventory, lookups, sources, and review notes.
Download XLSX worksheet →AI system inventory field guide
Plain field guide for each column in the register.
Download Markdown →See an example before downloading
Fictional, illustrative record: SYS-001, Customer Support Chatbot, from AI System Inventory row 4. The owners, role and risk values are example assumptions, not verified findings about a real system.
- AI System Name (B4)
- Customer Support Chatbot
- Intended Purpose (F4)
- Responds to routine customer support questions and escalates complex cases.
- Business Owner (M4)
- VP Customer Experience
- Human Oversight Owner (N4)
- Customer Support Lead
- EU AI Act Role (E4)
- Deployer
- Risk Level (H4)
- Limited
- Annex III Area / Trigger (I4)
- Not assessed
- Evidence Gap Status (Q4)
- Open
- Notes (R4)
- Article 50 transparency review: confirm user-facing AI disclosure and retain review evidence.
Open evidence question: has the user-facing AI disclosure been confirmed, and where is the review evidence?
To adapt it, replace the system, purpose and owners, review the role and risk assumptions, and add your evidence reference and next action in Notes. Use Review Notes to assign an action owner and target date. The example dates and status values are fictional too.
The workbook examples count in the dashboard until replaced or cleared.
What this template captures
The AI System Inventory sheet has 18 columns, A–R, with headers in row 3. The five fictional examples occupy rows 4–8. Use the column letters below to find each field. Supplementary governance prompts belong in Notes and Review Notes; they are not additional inventory columns.
| Column and field | How to use it |
|---|---|
| A · AI System ID | Stable reference for the system or use case. Spare IDs are prefilled; an ID alone does not count towards Started AI system records. |
| B · AI System Name | Name used by the business. Enter a meaningful text name when adding a system; every dashboard count uses the name-eligibility rule explained below. |
| C · Business Function | Business process or sector, such as customer operations, HR or engineering. |
| D · Provider / Vendor | Name the supplier or internal team. Describe an internal, external, open-source or mixed stack here or in Notes. |
| E · EU AI Act Role | Drop-down: Provider, Deployer, Importer, Distributor, Provider + Deployer, Unknown. Record the reasoning and any role not covered by these choices in Notes. |
| F · Intended Purpose | Describe the task the system is designed or used for. |
| G · AI System Type | Describe the technology or function, such as a conversational assistant or ranking system. |
| H · Risk Level | Drop-down: Minimal, Limited, High, Prohibited / Review Required, Unknown. These are workbook triage labels, not a legal determination; record assumptions in Notes. |
| I · Annex III Area / Trigger | Record the potential Annex III area and reasoning, or state that it has not been assessed. Put Article 50 review prompts in Notes. |
| J · Data Categories | Describe the data used, such as personal, special-category, operational, synthetic or public data. |
| K · Data Subject Groups | Identify affected people or user groups, such as customers, employees or job applicants. |
| L · Deployment Status | Drop-down: Ideation, Pilot, Production, Retired, Shadow / Unverified. Explain any other operational state in Notes. |
| M · Business Owner | Name the accountable business or process owner. |
| N · Human Oversight Owner | Name the person or role responsible for review, intervention and escalation. |
| O · Last Review Date | Date of the actual classification and evidence review. Leave blank if no review has taken place. |
| P · Next Review Date | Planned date for the next review. |
| Q · Evidence Gap Status | Drop-down: Open, In Progress, Closed, Blocked, Review Required. The dashboard Open count includes only eligible named records with the exact value Open. |
| R · Notes | Record assumptions, supplementary prompts, evidence references and the next action. Use the AI System ID to link detailed actions to Review Notes. |
Where supplementary governance details belong
Keep these useful prompts alongside the 18-column register. They do not have dedicated inventory columns.
- Technical owner
- Record the system, engineering or vendor-management owner in Notes (R). This is separate from Business Owner (M) and Human Oversight Owner (N).
- Automated decision impact
- In Notes (R), describe whether the system advises, supports, recommends or makes decisions, and record uncertainty.
- Article 50 transparency trigger
- In Notes (R), record the relevant interaction or content, the role assumption, the notice question and the evidence still needed. This is a separate review from Annex III.
- FRIA trigger / scoping
- Record the applicability question and rationale in Notes (R), with a review action in Review Notes. Recruitment use or a High risk label alone does not establish that a FRIA is required.
- Logs and evidence location
- Put file references or evidence links in Notes (R). Include relevant usage records, provider documents, approvals and oversight logs where available; do not invent evidence.
- Next action
- Summarise the action in Notes (R). In Review Notes, include the AI System ID in Area Reviewed (C), the finding or decision in D, Action Owner in E, Target Date in F and Status in G. Supporting detail belongs in H.
Review Notes has its own Status choices: Open, In Progress, Complete, Blocked. Include the system ID in each action record; links between sheets are manual.
How to use it
- Read the fictional example, then replace rows 4–8 with your own systems or clear their contents. Include approved systems, pilots and suspected shadow AI. Keep uncertain entries explicit.
- Assign Business Owner (M) and Human Oversight Owner (N). Record the technical owner and role or risk reasoning in Notes (R).
- Use the four inventory drop-downs consistently. Record an unresolved evidence question and next action in Notes (R), then assign the action in Review Notes using the AI System ID.
- Set Last Review Date (O) only after a review and plan Next Review Date (P). Revisit classification, transparency, FRIA scoping, provider evidence and oversight as the use case changes.
The five fictional examples count in the dashboard until replaced or cleared. Every dashboard count uses the same eligibility rule for B4:B195: the name must be text and remain non-empty after non-breaking spaces are replaced, control characters are removed and spaces are trimmed. Blank or formula-empty names, whitespace-only names and numeric values do not qualify. These placeholder names are also excluded, regardless of letter case: TBD, TBC, N/A, Select, Select..., Placeholder and [placeholder].
Started AI system records counts eligible names. Risk, deployment and evidence-gap counts apply the same name rule before matching their category. An unnamed record does not count even if High, Open or Shadow / Unverified is still recorded. Clear the whole record when removing an example.
Inventory dropdowns cover E4:E195, H4:H195, L4:L195 and Q4:Q195. Review Notes uses G2:G40. Start Here explains the controls and lists the choices; select one cell to use its arrow. The controls retain their input prompts and invalid-entry alerts.
The banded inventory table is A3:R58. Grey dropdown-cell formatting and validation extend through row 195, and dashboard formulas cover rows 4–195. Rows 59–195 are outside the existing table and its filters. Extend the table and its formatting separately if needed; extend validation and dashboard formulas deliberately when adding records beyond row 195.
FAQ
Is this a full compliance register?
No. It is the intake layer. Use it before role classification, high-risk analysis, FRIA, vendor review, and evidence planning.
Should shadow AI tools be included?
Yes. Include approved systems and suspected shadow AI. Mark uncertain entries clearly. A messy entry is still better than an invisible system.
Related EU AI Compass assets
Source and review note
This page is an educational evidence starter. It is not legal advice and does not confirm compliance. Review the official text of Regulation (EU) 2024/1689 and obtain qualified legal review before relying on any template for a formal compliance decision.
- Regulation (EU) 2024/1689 on EUR-Lex
- Inventory fields, input controls, dashboard counting and example reviewed: 12 October 2026, against the reconciled download and the public workbook retrieved that day.
- Supplementary review prompts checked: Article 27 and Article 50, European Commission AI Act Service Desk. This was a focused inventory review.