Use the AI Inventory to Identify Questions for Legal Review
Inventory each AI use case, not just the product name. Record owner, input, affected person or decision and deployment role, then assess EU AI Act classification against the applicable legal criteria separately.
A product list cannot show which decisions rely on AI or who checks its output. Record each use case and its owner so that a legal or risk review can examine the actual deployment, rather than infer obligations from a vendor name.
The tools to inventory first
Inventory the AI tools that touch decisions, sensitive data, customer outcomes, staff processes, regulated records or audit evidence first. Include public AI tools, Copilot-style assistants, AI features inside existing SaaS products, workflow automation platforms, analytics models, document review tools, chatbots, vendor APIs and any internal model or script used in a live process.
A simple rule works well: if someone relies on the output to decide, advise, prioritise, approve, reject, summarise, score, monitor or evidence something, it belongs in the inventory. If the tool only helps an individual draft low-risk internal notes with no sensitive data and no operational reliance, it may be low priority, but it should still be visible as a permitted or restricted use pattern.
Map your AI tools and control gaps
Use cases matter more than product names
The same product can sit in different risk categories depending on how it is used. A public AI assistant used to rephrase a generic internal email is not the same risk as the same assistant being used to analyse client documents, draft regulated advice or summarise a complaint file.
For each tool, record the use case rather than only the licence owner. A useful entry captures: the business process, owner, supplier, model or embedded AI feature, input data, output use, affected user or customer group, human review point, retention setting, training opt-out position, access controls, logs, known limitations and escalation route.
What should be in the inventory record?
Each inventory entry should answer five audit questions:
- What is the tool or AI feature? Include embedded AI inside core systems as well as standalone model subscriptions.
- Where is it used? Name the workflow, team, system and decision point.
- What data goes in? Separate public, internal, confidential, personal, special category and client-provided data.
- What does the output affect? Note whether it influences staff, customers, pricing, claims, legal advice, compliance evidence, finance, HR or operational decisions.
- What controls prove it is supervised? Capture human review, approval gates, logging, testing, retention, access limits, incident response and version history.
How to classify risk without overcomplicating the first pass
For the first pass, flag uses that need legal review, sensitive-data checks, closer output review or ordinary operational controls. These are internal review categories, not EU AI Act classifications. Determine the legal classification separately against the applicable criteria, including the system's intended purpose and the organisation's role.
Prioritise review where AI affects people, access to services or sensitive records. Recruitment, lending, insurance, legal work and identity checks are examples to examine, not a list of uses that are automatically high-risk under the Act. Record the precise decision and affected group, then check which legal and sector requirements apply to that deployment.
Set up a repeatable AI governance cadence
Do not miss shadow AI and embedded AI
Most weak inventories miss two categories. The first is shadow AI: staff using public tools or browser extensions outside approved processes. The second is embedded AI: features quietly added to CRM, finance, HR, document management, meeting, analytics or customer support platforms.
Ask teams what they use and compare their answers with procurement records and SaaS admin settings. Check extensions where appropriate and give staff a short route to declare new uses, including features added by existing suppliers.
How this supports EU AI Act readiness
The EU AI Act readiness value comes from traceability. If the organisation can show which systems exist, who owns them, why they are used, what data they touch, how outputs are reviewed and how incidents are handled, it is in a stronger position to map deployer obligations and respond to client or regulator questions.
The inventory is preparation for that assessment, not proof of compliance. Keep the jurisdiction, provider or deployer role, legal classification and applicable dates as separate review fields. Confirm them against current primary sources before relying on the record; an internal risk tier or a supplier assurance badge cannot settle them.
A 30-day starter plan
- Week 1: pull a list from procurement, SaaS admin consoles, security tooling and team leads.
- Week 2: interview process owners and identify the real decision points, data inputs and human review points.
- Week 3: classify each use case, flag sensitive or regulated uses, and assign accountable owners.
- Week 4: close the obvious gaps: banned data in public tools, missing review gates, absent logs, unclear vendor retention and no incident route.
Turn the inventory into an implementation plan
Conclusion
Keep the inventory current as tools and their uses change. For each entry, record who owns it, the data involved, the decision it supports and the review evidence. Use those details to assess applicable EU AI Act requirements separately, rather than treating the inventory itself as compliance evidence.
Need a safer AI route for your firm?
If your inventory lists products but not their uses, start with the decisions and records each tool touches. The linked services can help organise that work; legal classification and applicability still need their own review.
