EU AI Act AI inventory for small businesses: what to record for each AI system (free template)
Short answer: list every AI system you build or use, one entry each, with who owns it, which vendor and model sit behind it, what you use it for, your role under the EU AI Act (provider, deployer, importer or distributor), the result of a quick risk screen, the duties that follow, and the evidence that you acted on them. The Act doesn't use the word "inventory", but you can't apply its rules to systems you haven't listed, so this is the usual first step.
Which EU AI Act rules already apply
| Since / from | What applies | Why it matters for your list |
|---|---|---|
| 2 Feb 2025 | Banned practices (Article 5) and AI literacy for staff (Article 4) | You need to know every system to rule out banned uses and to brief the people who use them |
| 2 Aug 2026 | Transparency duties (Article 50), such as telling people they are talking to a chatbot or that content is AI-generated | Flag every customer-facing chatbot, voice bot or content generator |
| 2 Dec 2027 | High-risk rules for Annex III uses such as recruitment and credit scoring, as set by the Digital Omnibus on AI (Regulation (EU) 2026/1744) | Mark hiring, credit, education and biometric uses now so you have time to prepare |
| 2 Aug 2028 | High-risk rules for AI in regulated products (Annex I) | Relevant if AI is part of a product you make or import |
Check the official text before relying on a date: Regulation (EU) 2024/1689 on EUR-Lex and Regulation (EU) 2026/1744 on EUR-Lex.
The fields to record for each AI system
| Field | Example |
|---|---|
| Name and short description | "Website support chatbot answers order questions" |
| Internal owner | The person who answers for it, not the vendor |
| Vendor and product | The SaaS tool or library you use |
| General-purpose model behind it | Whether it runs on a large general-purpose model, and which one if the vendor says |
| Your role | Deployer (you use it), provider (you built it or put your name on it), importer or distributor |
| Purpose and who it affects | Customers, staff, job applicants, the public |
| Banned-practice screen (Article 5) | No / not sure, with a note |
| High-risk screen (Annex III use or Annex I product) | No / possibly, with which category |
| Transparency triggers (Article 50) | Talks to people? Generates images, audio, video or text for the public? |
| Starting-point tier | Minimal, transparency, possibly high-risk, possibly banned |
| Duties and their dates | For example, "chatbot disclosure, applies since 2 Aug 2026" |
| Status and human review | Live, pilot or retired, plus your own final decision and date |
| Evidence | Policy approval, staff briefing, vendor documents, notices shown to users |
A 30-minute way to start
- Ask each team which AI tools they use, including free ones and features switched on inside tools you already pay for.
- Add one row per system with the fields above. "Not sure" is a fine answer for now; mark it so you come back to it.
- Run the banned-practice and high-risk screens. Anything that touches hiring, credit, education, biometrics or medical use goes to a qualified lawyer.
- Write a short AI use policy and brief the staff who use these tools. Record the date as evidence.
- Set a reminder to review the list every quarter and whenever you add a new tool.
Where to keep it
A spreadsheet works. If you'd rather have the screening questions, duties by role and dates built in, the EURO AI Register free edition runs in your browser with no account and no upload, for up to 3 AI systems and 10 evidence records. It also generates an AI use policy from your entries and prints a report. A paid membership removes the limits and adds rule updates; you don't need it to follow this guide.
This guide is general information, not legal advice. A register is a record-keeping aid, not proof of compliance, and a tier from your own answers is a starting point, not a legal classification. Unadhi is not affiliated with the EU or any EU authority.
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.