# AI System Inventory - **Type**: Template (Register) - **Page**: https://aipolicytracker.org/templates/ai-system-inventory - **Formats**: XLSX and DOCX - **Current version**: v7, built 2026-11-12 One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet. ## What is inside - Inventory sheet with dropdowns for lifecycle stage, legal role, jurisdiction and EU AI Act tier - Automatic next-review date and overdue flag - Reference sheet: every recorded duty by legal role, with its source reference and record link - Reference sheet: jurisdictions with binding AI law ## Laws and frameworks it is built from - EU AI Act (European Union), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act - Colorado ADMT law (SB 26-189) (Colorado (United States)), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/us-colorado-automated-decision-making-technology-act ## Recorded duties it covers - Establish accountability processes and a risk-management process (guardrails 1 and 2) (Australian Voluntary AI Safety Standard): https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management - Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission - Frontier developers must protect employees who report catastrophic-risk concerns (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections - Keep records of consequential decisions influenced by the technology for three years (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping - Developers must supply deployers with documentation of the technology (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation - Draw up technical documentation before placing a high-risk system on the market (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation - Design high-risk systems to log events automatically (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-record-keeping - Use high-risk AI as instructed, monitor it and inform affected people (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations - Providers must meet the full set of provider duties for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations - Providers must keep high-risk AI documentation for ten years (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping - Providers must retain automatically generated logs under their control (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention - Providers must supply conformity evidence and log access to authorities on request (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities - Non-EU providers must appoint an EU authorised representative for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative - Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider - Providers must document and register a conclusion that an Annex III system is not high-risk (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation - Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation - Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification - Providers of GPAI models must maintain technical documentation and inform downstream providers (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation - Non-EU providers of GPAI models must appoint an EU authorised representative (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative - Adopt the guiding principles and risk-based governance (voluntary) (India AI Governance Guidelines): https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance - Government bodies to promote ethical, responsible and inclusive AI (policy commitment) (Nepal National AI Policy): https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles - Establish internal governance structures and measures for AI (Singapore Model AI Governance Framework): https://aipolicytracker.org/obligations/singapore-mgf-internal-governance - Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation - Foreign AI business operators above the threshold must designate a domestic representative in Korea (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative - Government commitment to AI ethics, governance and regulation (strategy objective) (UAE AI Strategy 2031): https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment - Use AI in ways that are fair and do not discriminate unlawfully (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-fairness - Establish accountability and governance for AI (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-accountability-governance - Establish AI governance policies, roles and accountability (Govern) (NIST AI RMF): https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern ## Latest changes Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Duties by role": 107 → 119 rows (+12). Record citations: 199 → 211. - **Retrieved**: 2026-11-12 - **Licence**: https://creativecommons.org/licenses/by/4.0/ > Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.