How should organisations prepare their AI inventory for EU AI Act compliance?

What an AI inventory needs to contain for EU AI Act scoping

A useful inventory is more than a list of tools. It should identify every AI system in use or development, describe its business purpose, classify it by risk, and record where it is deployed. It should also capture the data sources, governance controls, and ownership details needed to decide which obligations apply and to demonstrate that the organisation made those decisions consistently.

The inventory should be complete enough to support scoping, not merely discovery. That means covering build, buy, configure, embed, and pilot use cases, including systems that may sit inside other platforms. The AI Register and AI Inventory Template is useful here because it focuses on the fields that turn a register into an operational control rather than a static spreadsheet.

How to classify systems so the inventory can drive compliance

Classification is the step that turns raw inventory data into legal and operational action. Each system should be tagged against its business function, intended use, and likely EU AI Act risk category so the organisation can separate low-risk internal use from systems that may trigger higher obligations, additional governance, or formal assessment.

That classification should be tied to the system’s actual role in the business, not to vendor labels or marketing claims. Where a system may fall into a regulated use case, the inventory should preserve enough context to support later review of provider, deployer, or modified-system duties. NHIMG’s EU AI Act High-Risk AI Systems Guide helps connect that classification step to the obligations that follow when a system is more than ordinary business automation.

Use a consistent rubric across teams so one business unit does not record the same class of system as “analytics,” another as “automation,” and a third as “AI assistant.” If the classification method is inconsistent, the inventory stops being a control point and becomes a reporting exercise.

How to operationalise the inventory as a living control

An AI inventory only works if it is maintained through change, not rebuilt during audits. New systems, major model changes, new data sources, and deployment moves should all trigger an update. The inventory also needs owners, review cadence, and evidence fields so compliance teams can trace how a system was assessed, approved, or escalated.

Discovery has to be continuous because the hardest gap is usually shadow use. Unmanaged tools, embedded AI features, and agent-style workflows often appear first in procurement, cloud, identity, or endpoint telemetry rather than in formal architecture reviews. The Shadow AI and AI Agent Discovery Guide is relevant because it maps the practical signals that help teams find systems before they escape governance.

Where organisations plan to industrialise the process, they should also define who can approve changes to the register, what evidence must be retained, and when a system must be reclassified. The EU AI Act does not reward best-effort inventories; it rewards inventories that can support repeatable decisions, escalation, and auditability. For that reason, many teams use a central register rather than letting each function maintain its own version.

Practitioner Guidance

What to prioritise: Start with systems that are externally facing, decision-influencing, or likely to be high impact, then work inward to low-risk internal use. Those are the systems most likely to create compliance exposure if they are omitted or misclassified.

What to verify: Every listed system should have an owner, a business purpose, a deployment location, a source-of-truth classification, and a documented review date. If any of those fields are missing, the inventory is not yet operational enough for compliance decisions.

Common mistake: Treating the inventory as a one-time procurement exercise. That approach misses embedded features, pilots, and reconfigured systems, which are exactly where scope drift happens.

Practitioner takeaway: The inventory should function as the organisation’s evidence-backed decision layer, so if a system changes, the register changes with it before the compliance position does.

Related resources from NHI Mgmt Group

• Guide: EU AI Act Compliance Guide
• AI Act Compliance
• How should enterprises prepare for EU AI Act compliance in regulated AI programmes?
• What should teams do first when they need to prepare for EU AI Act compliance?
• What do organisations get wrong when they prepare for EU AI Act compliance too late?