AI systems inventory: how to build it step by step

01

The short answer

A business builds the inventory by listing every AI system according to the definition in Article 3, point 1 of Regulation (EU) 2024/1689, noting for each the business role taken on — provider, deployer, importer, distributor or authorised representative — and the data processed to generate the outputs.

This is one of the questions listed as an approved verification question to guide internal AI governance.

02

Why the role changes everything

The Regulation clearly distinguishes provider, deployer, importer, distributor, authorised representative and, more generally, operator. Each role carries different obligations, so the inventory cannot simply list software: it must record who does what with respect to each system, consistent with the definitions in Article 3.

03

Steps to build the inventory

Steps

1. List every automated system that infers outputs from inputs, according to the definition of an AI system.
2. Assign each system the correct business role: provider, deployer, importer, distributor or authorised representative.
3. If the business is a provider of a high-risk AI system, record in the quality management system the intended purpose and the data processed during acquisition, collection, analysis, labelling and storage.
4. Check whether the system generates synthetic content subject to marking or disclosure obligations, such as deep fakes.
5. If the business is a provider of a high-risk AI system, note in the accountability framework who, among management or staff, is responsible for each aspect of the quality management system.

04

A hypothetical example

Hypothetical example: a company uses a third-party system to generate marketing texts and develops in-house a customer categorisation system. For the first, the company is a deployer and checks whether synthetic outputs are marked as artificially generated, as required of providers of such systems. For the second, being an in-house development, the company records its own data management processes, from acquisition to storage.

05

Minimum items to record for each system

• System name and the technical definition applied (AI system).
• Business role assumed with respect to the system (provider, deployer, importer, distributor, authorised representative).
• Intended purpose and, for providers of high-risk AI systems, the data processed across the stages of the data lifecycle set out in the quality management system.
• Any transparency obligations for synthetic content or deep fakes applicable to the system.
• For providers of high-risk AI systems, the person responsible for each aspect noted in the quality management system's accountability framework.

06

What can be configured in a management software

A company can ask its software partner to support a structured register of AI systems, with fields for role, purpose, data processed and responsible contact, so the inventory stays searchable and updatable over time.

This is a recommended operational choice, not a product requirement: each organisation defines which information to track and who may modify it, while remaining consistent with the roles set out in the Regulation.

07

Frequently asked questions

The inventory should be updated whenever a new system is introduced or the business role regarding an existing system changes, because different roles require different records.

An in-house system developed by the company itself should still be listed in the inventory with role and purpose under the Article 3 definitions; if the company takes on the role of provider of a high-risk AI system, the quality management data required for that role should also be added.

Obligations to mark synthetic content specifically apply to providers of systems that generate audio, image, video or text outputs, and should be noted in the inventory when relevant.

08

Next step

Start by listing the AI systems already in use at your company, assigning a role and a contact person to each: it is the first concrete step towards traceable AI governance.