{"data":{"slug":"ai-system-inventory","title":"AI System Inventory","type":"register","formats":["xlsx","docx"],"topics":["inventory","governance","evidence"],"frameworks":["eu-ai-act","iso-42001","nist-ai-rmf"],"short":"One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet.","covers":{"categories":["governance_accountability","technical_documentation","record_keeping"]},"version":7,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:16+00:00","citations":211,"downloads":42,"files":[{"format":"xlsx","filename":"ai-system-inventory-v7.xlsx","bytes":70501,"url":"https://aipolicytracker.org/templates/ai-system-inventory#download"},{"format":"docx","filename":"ai-system-inventory-v7.docx","bytes":14278,"url":"https://aipolicytracker.org/templates/ai-system-inventory#download"}],"url":"https://aipolicytracker.org/templates/ai-system-inventory","inside":["Inventory sheet with dropdowns for lifecycle stage, legal role, jurisdiction and EU AI Act tier","Automatic next-review date and overdue flag","Reference sheet: every recorded duty by legal role, with its source reference and record link","Reference sheet: jurisdictions with binding AI law"],"legal_basis":["eu-ai-act","us-colorado-automated-decision-making-technology-act","iso-42001"],"caveat":null,"covered_obligations":[{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","policy":"australia-voluntary-ai-safety-standard","source_reference":"Guardrails 1 and 2","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"us-california-ccpa-risk-assessment-submission","title":"Submit risk assessment information to the California Privacy Protection Agency each year","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, § 7157","url":"https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","policy":"us-california-sb-53","source_reference":"Labor Code Section 1107 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"us-colorado-admt-record-keeping","title":"Keep records of consequential decisions influenced by the technology for three years","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping"},{"slug":"us-colorado-admt-developer-documentation","title":"Developers must supply deployers with documentation of the technology","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation"},{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","policy":"eu-ai-act","source_reference":"Article 11 and Annex IV","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation"},{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","policy":"eu-ai-act","source_reference":"Article 12; Article 26(6) for deployers","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping"},{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","policy":"eu-ai-act","source_reference":"Article 26","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","policy":"eu-ai-act","source_reference":"Article 16","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","policy":"eu-ai-act","source_reference":"Article 18","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","policy":"eu-ai-act","source_reference":"Article 19","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","policy":"eu-ai-act","source_reference":"Article 21","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","policy":"eu-ai-act","source_reference":"Article 22","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","policy":"eu-ai-act","source_reference":"Article 25(1) and 25(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","policy":"eu-ai-act","source_reference":"Article 6(4); Article 49(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","policy":"eu-ai-act","source_reference":"Article 26(10)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-art-52-systemic-risk-notification","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","policy":"eu-ai-act","source_reference":"Article 52(1)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification"},{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","policy":"eu-ai-act","source_reference":"Article 53(1)(a) and 53(1)(b); Annexes XI and XII","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","policy":"eu-ai-act","source_reference":"Article 54","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","policy":"india-ai-governance-guidelines","source_reference":"Guiding principles and recommendations sections","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","policy":"nepal-national-ai-policy","source_reference":"Policy objectives and strategies (to be confirmed against the official text)","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","policy":"singapore-model-ai-governance-framework","source_reference":"Second edition, Part on internal governance structures and measures","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation"},{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 36","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative"},{"slug":"uae-ai-strategy-ethics-and-governance-commitment","title":"Government commitment to AI ethics, governance and regulation (strategy objective)","policy":"uae-national-ai-strategy-2031","source_reference":"Strategy objectives on governance and ethics (reviewer to cite the section)","url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 3, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 4, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","policy":"us-nist-ai-rmf","source_reference":"GOVERN function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"}],"versions":[{"version":7,"generated_at":"2026-11-12T05:14:16+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 4559f86f527b → ef1018b7a6a2. Sheet \"Duties by role\": 107 → 119 rows (+12). Record citations: 199 → 211.","stats":{"sheets":{"Inventory":0,"Duties by role":119,"Jurisdictions":80},"blocks":75,"headings":15,"citations":211}},{"version":6,"generated_at":"2026-10-16T05:30:00+00:00","dataset_version":"4559f86f527b","changelog":"Dataset 1e8ea28a8a93 → 4559f86f527b. Sheet \"Jurisdictions\": 42 → 80 rows (+38). Record citations: 161 → 199.","stats":{"sheets":{"Inventory":0,"Duties by role":107,"Jurisdictions":80},"blocks":75,"headings":15,"citations":199}},{"version":5,"generated_at":"2026-10-09T05:30:00+00:00","dataset_version":"1e8ea28a8a93","changelog":"Dataset 52bd836b1d6b → 1e8ea28a8a93.","stats":{"sheets":{"Inventory":0,"Duties by role":107,"Jurisdictions":42},"blocks":75,"headings":15,"citations":161}},{"version":4,"generated_at":"2026-10-08T05:30:00+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 9710140e23e4 → 52bd836b1d6b.","stats":{"sheets":{"Inventory":0,"Duties by role":107,"Jurisdictions":42},"blocks":75,"headings":15,"citations":161}},{"version":3,"generated_at":"2026-10-06T05:30:00+00:00","dataset_version":"9710140e23e4","changelog":"Dataset 3335c39da4b7 → 9710140e23e4.","stats":{"sheets":{"Inventory":0,"Duties by role":107,"Jurisdictions":42},"blocks":75,"headings":15,"citations":161}},{"version":2,"generated_at":"2026-09-27T05:30:00+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7. Sheet \"Duties by role\": 112 → 107 rows (-5). Document: 77 → 75 blocks. Record citations: 166 → 161.","stats":{"sheets":{"Inventory":0,"Duties by role":107,"Jurisdictions":42},"blocks":75,"headings":15,"citations":161}},{"version":1,"generated_at":"2026-09-26T13:05:03+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Inventory":0,"Duties by role":112,"Jurisdictions":42},"blocks":77,"headings":15,"citations":166}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}