AI inventory

The inventory is the list of every AI system your brand uses — with vendor, area of use, data types processed, contract status and the responsible person. It is the first thing market surveillance asks for and the basis of every further duty.

New entries start without a risk tier. The risk assistant walks through nine questions and then tags the system automatically — prohibited, high, limited or minimal. The answers are kept, so it stays traceable later why the classification came out as it did.

• Before the first productive use. The classification decides whether you may use the system at all — that is settled beforehand, not afterwards.
• When the purpose changes. A chatbot that suddenly pre-sorts applications is a different system in the sense of the regulation. Re-assess it.
• On a change of vendor. Vendor and model are part of the entry; they decide who the GPAI request goes to.

1. 1

   Create the system

   Via “New AI system”. Name, vendor and area of use are enough for a first entry.

2. 2

   Add data types and contract

   Public, internal, personal or sensitive data — and whether a data-processing agreement is in place.

3. 3

   Run the risk assistant

   Nine questions on purpose, affected people and context of use. At the end you get the tier, with the triggers that led to it.

4. 4

   Work through the duties

   Depending on the tier: transparency notice, registration in the EU database, technical documentation or a fundamental-rights impact assessment.

5. 5

   Re-assess on changes

   The assistant can be run again at any time; the previous assessment stays in the history.