Inventorying your AI systems for the AI Act: how to approach it

Short answer: Inventorying your AI systems for the AI Act (Regulation (EU) 2024/1689) begins with classification: for each system, establish which risk category it falls into. The Regulation sets out four categories — prohibited (Article 5), high-risk (Article 6 with Annexes I and III), limited-risk with transparency obligations (Article 50), and minimal-risk with no specific obligations. Only once that classification is settled can you determine the applicable obligations per system and the role your organisation plays.

Start by defining scope: what is an AI system

The first step is establishing what you need to inventory at all. Article 3(1) of the Regulation defines an AI system as a machine-based system that operates with some degree of autonomy, may adapt after deployment, and infers from its input how to generate outputs such as predictions, recommendations or decisions. Not every automated rule or classical statistical model qualifies; scoping is therefore a factual assessment for each system.

Compile a list of all systems that may fall within this definition — both in-house developed and procured software, and both standalone applications and AI embedded in a product or service. For each system, record the purpose, the data used, the output, and the context of use. You will need this information for classification and, later, for the technical documentation that high-risk systems require.

Classify each system: the four categories

For each system on your list, determine the risk category. Start with Article 5: practices such as certain forms of manipulation, social scoring and — subject to conditions — biometric categorisation are prohibited. If a system falls within these, it may not be used.

If it is not prohibited, assess it against Article 6. A system is high-risk if it is a safety component of, or is itself a product covered by, the harmonisation legislation listed in Annex I and requires a third-party conformity assessment, or if it falls within one of the use areas of Annex III (such as recruitment, critical infrastructure or access to essential services). Article 6(3) provides an exception where the system does not pose a significant risk to health, safety or fundamental rights; that assessment must be documented.

If a system is not high-risk but does fall under Article 50 — for example chatbots or systems that generate synthetic content — transparency obligations apply. The remainder is in principle minimal-risk, with no specific obligations under the Regulation.

Map role and obligations to each system

Classification alone is not enough: obligations also depend on your role. The Regulation distinguishes, among others, the provider (the party that develops a system, or has it developed, and places it on the market under its own name) and the deployer (the party that uses the system under its own authority). For procured systems you are typically the deployer; with in-house development or substantial modification you may become a provider, with heavier obligations.

In your inventory, record for each system: the classification, its justification, your role, and the resulting obligations. This produces a register that forms the basis for further compliance and that you can update as systems or the legal framework change. The exact dates of application for high-risk obligations are still under discussion; consult the timeline for these.

Read more: AI Act: timeline of obligations.

Take the scan.