AI System Inventory
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI System Inventory is a free XLSX and DOCX register for EU AI Act, ISO/IEC 42001 and NIST AI RMF. One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet.
- Format
- XLSX and DOCX · Register
- Version
- v7, built 12 Nov 2026
- Duties cited
- 28 from 12 instruments
- Rows from the records
- 199
- Frameworks
- EU AI Act, ISO/IEC 42001, NIST AI RMF
- Written for
- Provider / developer, Deployer / user organisation, General-purpose AI model provider
- Price and licence
- Free · CC BY 4.0
What's inside
- Inventory sheet with dropdowns for lifecycle stage, legal role, jurisdiction and EU AI Act tier
- Automatic next-review date and overdue flag
- Reference sheet: every recorded duty by legal role, with its source reference and record link
- Reference sheet: jurisdictions with binding AI law
Preview
The sheets and sections of version v7, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Inventory
| System ID | System name | Business owner | Intended purpose | Lifecycle stage ▾ | Your role under the law ▾ | Primary jurisdiction ▾ | EU AI Act tier ▾ | Personal data ▾ | Automated decisions about people ▾ | Vendor | Model / provider | Data sources | Last review | Next review ƒ | Review status ƒ | Evidence link | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||||||||||
One row per AI system, including third-party tools with AI features. Decide the role before the tier: obligations follow the role.
Sheet: Duties by role
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Establish accountability processes and a risk-management process (guardrails 1 and 2) | Governance and accountability | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 1 and 2 | Guardrail 1 asks organisations to set up accountability processes including governance, internal capability and a strategy for regulatory compliance; guardrail | AI accountability and risk-management documentation | Clauses 5 and 6 | GOVERN and MAP | Pending review · source-linked | https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management | |
| Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) | Human oversight | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 4, 5 and 6 | Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enab | Test reports and user disclosure records | MEASURE and MANAGE functions | Pending review · source-linked | https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency | ||
| Provide contestability, supply-chain transparency and records (guardrails 7 to 9) | Vendor and supply-chain governance | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 7, 8 and 9 | Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, model | AI system register and supplier disclosures | GOVERN 6.x | Pending review · source-linked | https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records | ||
| Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision | Transparency and disclosure | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7220 | 2027-01-01 | A business that uses automated decision-making technology (ADMT) to make a significant decision about a consumer (one that provides or denies financial or lendi | The published Pre-use Notice for each use, with the date it went live and where it is shown; A record of which significant decisions use ADMT and which notice c | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice | ||
| Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal | Human oversight | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7221 | 2027-01-01 | Consumers must be able to opt out of the use of ADMT for a significant decision, through at least two designated methods that are easy to use and need minimal s | The opt-out link, form and second method, and a log of requests with dates received and processing stopped; Notices sent to service providers and contractors ab | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out | ||
| Answer consumers' requests to access information about how automated decision-making technology was used about them | Transparency and disclosure | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7222 | 2027-01-01 | On a verified request, the business must explain in plain language the specific purpose for which it used ADMT about the consumer; the logic of the ADMT, enough | An access-response template per system and a log of requests answered; Contract terms requiring vendors to assist with access requests | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-access |
Every recorded duty, with the roles it binds. Filter the "Who it binds" column by the role you chose in the inventory.
Sheet: Jurisdictions
| Jurisdiction | Binding instrument | Status | Applies from | Record |
|---|---|---|---|---|
| Alberta (Canada) | Alberta government AI usage policy | In force | https://aipolicytracker.org/policies/ca-alberta-government-ai-usage-policy | |
| Argentina | Decisión Administrativa 899/2024 | In force | https://aipolicytracker.org/policies/argentina-decision-administrativa-899-2024 | |
| Argentina | Disposición 2/2023 | In force | https://aipolicytracker.org/policies/argentina-disposicion-2-2023 | |
| British Columbia (Canada) | British Columbia public service generative AI policy | In force | https://aipolicytracker.org/policies/ca-british-columbia-generative-ai-policy | |
| Buenos Aires Province (Argentina) | Buenos Aires Province AI framework decree | In force | https://aipolicytracker.org/policies/ar-buenos-aires-province-decree-742-2026-ai | |
| Calabria (Italy) | Calabria AI law (Regional Law 4/2026) | Adopted | https://aipolicytracker.org/policies/it-calabria-regional-law-4-2026-ai |
Document outline (DOCX)
- Why an inventory
- Fields and what to record
- Duties that require a record of your systems
- Establish accountability processes and a risk-management process (guardrails 1 and 2)
- Submit risk assessment information to the California Privacy Protection Agency each year
- Frontier developers must protect employees who report catastrophic-risk concerns
- Keep records of consequential decisions influenced by the technology for three years
- Developers must supply deployers with documentation of the technology
- Draw up technical documentation before placing a high-risk system on the market
- Design high-risk systems to log events automatically
- Use high-risk AI as instructed, monitor it and inform affected people
- Providers must meet the full set of provider duties for high-risk AI
- Providers must keep high-risk AI documentation for ten years
- Providers must retain automatically generated logs under their control
- Providers must supply conformity evidence and log access to authorities on request
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX and DOCX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v7), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "Inventory" sheet for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "Duties by role" and "Jurisdictions" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Complete the document. Work through the DOCX sections (Why an inventory, Fields and what to record, Duties that require a record of your systems) and replace each placeholder with your organisation's answer.
- 6Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (28)
Each is cited in the file with its source reference and a link back to the record.
- Establish accountability processes and a risk-management process (guardrails 1 and 2)
- Submit risk assessment information to the California Privacy Protection Agency each year
- Frontier developers must protect employees who report catastrophic-risk concerns
- Keep records of consequential decisions influenced by the technology for three years
- Developers must supply deployers with documentation of the technology
- Draw up technical documentation before placing a high-risk system on the market
- Design high-risk systems to log events automatically
- Use high-risk AI as instructed, monitor it and inform affected people
- Providers must meet the full set of provider duties for high-risk AI
- Providers must keep high-risk AI documentation for ten years
- Providers must retain automatically generated logs under their control
- Providers must supply conformity evidence and log access to authorities on request
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v7 | ef1018b7a6a2 | Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Duties by role": 107 → 119 rows (+12). Record citations: 199 → 211. | |
| v6 | 4559f86f527b | Dataset 1e8ea28a8a93 → 4559f86f527b. Sheet "Jurisdictions": 42 → 80 rows (+38). Record citations: 161 → 199. | |
| v5 | 1e8ea28a8a93 | Dataset 52bd836b1d6b → 1e8ea28a8a93. | |
| v4 | 52bd836b1d6b | Dataset 9710140e23e4 → 52bd836b1d6b. | |
| v3 | 9710140e23e4 | Dataset 3335c39da4b7 → 9710140e23e4. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. Sheet "Duties by role": 112 → 107 rows (-5). Document: 77 → 75 blocks. Record citations: 166 → 161. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI System Inventory?
Inventory sheet with dropdowns for lifecycle stage, legal role, jurisdiction and EU AI Act tier. Automatic next-review date and overdue flag. Reference sheet: every recorded duty by legal role, with its source reference and record link. Reference sheet: jurisdictions with binding AI law.
Which duties does it cite?
28 recorded duties from Australian Voluntary AI Safety Standard, California CPPA automated decision-making rules, California SB 53 and Colorado ADMT law (SB 26-189), including Guardrails 1 and 2, Cal. Code Regs. tit. 11, § 7157, Labor Code Section 1107 (as added by SB 53), Article 11 and Annex IV, Article 12; Article 26(6) for deployers and Article 26. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and general-purpose ai model provider. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX and DOCX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v7 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the Shadow AI Discovery Assessment (21 questions, about 6 minutes) and the AI Model & Data Inventory Readiness (21 questions, about 6 minutes). They are free and run on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.