AI System Inventory & Register
Build the register every AI governance programme starts from: each AI system with its owner, purpose, supplier, personal data, decision impact and EU AI Act risk class — with high-risk, automated-decision and overdue-review systems flagged automatically.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- You cannot govern AI you have not found. The register is the input to impact assessments, supplier reviews, the Statement of Applicability and EU AI Act obligations.
- Ten columns per system, including decision impact (informational, advisory, automated decision) and EU AI Act risk class.
- The summary counts systems by risk class and names the ones that are high-risk or make automated decisions about people using personal data.
- A 17-item checklist covers how the register itself is kept complete: definition, intake gate, shadow-AI discovery, review cadence and reporting.
Frequently asked questions
What should an AI system inventory include?
At minimum: a name, accountable owner, purpose, who supplies the model, what data it uses (especially personal data), how much its outputs affect decisions about people, its regulatory risk class, its deployment status and when it was last reviewed. Include AI features switched on inside SaaS products you already use and general-purpose assistants staff use for work — these are the entries most registers miss.
How do I assign the EU AI Act risk class?
Work through the prohibited-practice categories first, then the high-risk use areas, then the transparency duties; anything else is minimal risk. The free EU AI Act Classifier walks through those questions. Record "Not yet classified" with a due date rather than guessing, and get legal review for anything borderline.
Is an AI inventory required by ISO/IEC 42001?
An AI management system needs to know which AI systems are in its scope, and most of its controls (impact assessment, life-cycle, data, third parties) are applied per system, so in practice a maintained register is the backbone of the system. This template gives you the structure; your auditor decides whether your records are adequate.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.