Free resource
The inventory an AI management system starts from: AI you build, buy or use, owners, data, affected people, risk, impact assessment status, human oversight and the EU AI Act view. Template with fictional example rows.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Template. Read this tab first. This is a working tool for your own team - it does not replace the standard or scheme text you are certified against, and it is not a certificate or an audit.
| Topic | Detail |
|---|---|
| What this is | An inventory of the AI systems your organisation develops, provides or uses - the starting point for an AI management system under ISO/IEC 42001:2023. Scope, risk assessment, impact assessment and controls all depend on it. |
| What counts | Include AI you build, AI embedded in products you buy (CRM, HR, support tools) and general-purpose AI your staff use. Procurement is the most common way AI enters an organisation unnoticed. |
| EU AI Act | The classification column is for your legal assessment. ISO 42001 does not determine AI Act classification, and certification is not AI Act conformity. High-risk obligations for Annex III systems apply from 2 December 2027 under Regulation (EU) 2026/1744. |
| The #1 mistake | Listing only the models the engineering team built and missing the third-party AI features switched on in existing software. |
Sheet: AI inventory
Example rows are fictional. One row per AI system or use case. Review the inventory whenever a model, provider or use changes, and at least at each management review.
| ID | AI system / use case | Purpose and output | Build / buy / embedded | Model or provider | Your role (developer / provider / user) | Data used (personal data?) | Who is affected | Business owner | Risk (H / M / L) | Impact assessment (date) | AI Act classification (legal view) | Human oversight | Last review |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AI-01 | Customer support assistant | Drafts replies to support tickets; agent approves | Buy | [LLM provider] | User / deployer | Ticket text; may include personal data | Customers | Head of Support | M | - | To be assessed | Agent approves every reply | - |
| AI-02 | CV screening in HR software | Ranks applicants for recruiters | Embedded | [HR vendor feature] | User / deployer | Applicant personal data | Job applicants | Head of People | H | - | Possibly Annex III - legal review needed | Recruiter reviews all rankings | - |
| AI-03 | Demand forecasting model | Weekly stock forecast | Build | In-house model | Developer and user | Sales history, no personal data | Internal | Supply Chain Lead | L | - | Not expected to be high-risk | Planner adjusts forecast | - |
| AI-04 | Code assistant | Suggests code to engineers | Buy | [Provider] | User | Source code | Internal; indirectly customers | CTO | M | - | To be assessed | Code review before merge | - |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources