AI system inventory and registry.

We record every AI system in the organisation in a single registry, shadow AI and AI embedded in vendor tools included. Each system gets an owner, a purpose, a role under the Act and a risk tier. This is the reference inventory everything else builds on.

Duration: 2 to 4 weeks
Covers: In-house AI, vendor AI, shadow AI
Qualification: Role and risk tier per system
Output: Single registry and update procedure

Scope an inventory

What is not recorded is not governed

AI enters the organisation through three doors: the models your teams build, the AI features vendors add to tools already in place, and the uses teams take up without declaring them. The Act applies to all three. A classification, an audit or a policy only holds for the systems you know about.

A registry, not a frozen spreadsheet

An inventory drawn up once is out of date at the next software purchase. We deliver the registry together with its update procedure: who declares a new system, at what point, and who signs off its classification.

Scope

What the registry holds for each system.

One entry per system, with the same fields for all of them, so that systems can be compared and you can decide which to deal with first.

Identity and owner. A name, a description, an owning department and a named person who answers for it.

Purpose and decisions. What the system does, the decisions it takes or prepares, and the people those decisions affect.

Data used. The categories of input data, where they come from, and whether personal data is involved.

Origin of the system. Built in-house, bought from a vendor, or an AI feature embedded in an existing tool.

Role under the Act. Provider or deployer, with the reason for the qualification, including any modification of the system or use of your own brand on it.

Risk tier. Prohibited, high risk, limited risk or minimal risk, with the written justification for the classification.

Status. Planned, in test, in production or retired, and how widely it is deployed.

Available documentation. What already exists, vendor contracts and instructions for use included, and what is missing.

Point to watch

The AI nobody declared. Uses taken up by teams and AI features switched on in tools already purchased appear on no project list. The inventory surfaces them through procurement records, contracts and a declaration questionnaire sent to each department.

How we run it

Five steps, from scope to a registry that stays current.

FramingThe scope covered, one entity, one department or the group, the working definition of an AI system and the fields of the registry.
DiscoveryInterviews with business, data and IT teams, a review of software purchases and vendor contracts, and a declaration questionnaire for undeclared uses.
Identity cardsOne card per system: owner, purpose, data used, origin and status.
Qualification and classificationThe role, provider or deployer, and the risk tier of each system, each with its written justification.
Readout and handoverThe registry, the list of systems to deal with first and the update procedure, handed over to the person who will keep the registry.

Deliverables

What you receive.

AI system registry Identity card per system Provider or deployer qualification Risk classification Shadow AI findings Vendor AI findings List of priority systems Update procedure Executive summary

Who the inventory is for

Compliance, risk, legal, data and IT leaders, data protection officers and heads of AI governance who need to know what the organisation runs before deciding what to audit.

Before and after the inventory

The inventory opens the journey.

Before · Method

The compliance journey

The inventory is its first cycle: knowing what exists, who answers for it and what each system decides.

After · Assess

AI system compliance audit

The registry points to the systems to audit first, those with the highest risk tier.

Next step

Scope an inventory.

Tell us the perimeter you have in mind, one entity, one department or the whole group. We will come back with a proposed scope, a duration and a fixed fee.

Write to us