Skip to content

International AI Safety, Governance & Assurance Alliance

Back to Resources

AI Insights

An AI inventory you can finish in an afternoon

6 min read · Updated 2026-11-08

Four columns are enough

Open a sheet. The columns are: tool name, what it does in our work, what goes in, and who is affected by what comes out. A row can be a product you pay for, a feature inside a product you already had, or a chat account someone opened.

"What it does" should be a verb you can check: drafts replies, summarizes calls, ranks leads, reads invoices, translates tickets. "Who is affected" might be customers, staff, applicants, patients, students, or only the person using the tool.

Spend the afternoon on questions, not on software

Sit with one person from each team for fifteen minutes. Ask what they used in the last month that wrote or scored something. Ask what they would not want a customer to see. Write their words in the sheet. Resist the urge to buy a catalogue tool before the sheet exists. The sheet is the thing you will argue about, and that argument is the inventory.

Mark rows where personal information goes in, or where a person outside the team feels the output. Those rows are the ones to look at first.

What the sheet is for

The sheet is a map. It is not a finding that you comply with any law, and it is not a risk rating. It tells you where to write a rule, where to ask a vendor a question, and where a person should check an output before it travels. Update it when a team adopts a new tool. An inventory that is a year old is a story about last year.

This is general education, not legal advice. Our free screening walks through similar questions if you want a prompted version of the same afternoon.

This article is general education, not legal advice. ComplianceEU Alliance is an independent private initiative, not a regulator or certification body.