Every EU AI Act conversation starts with the same question. An enterprise buyer's questionnaire asks which of your features use AI. An investor's request list asks what the product does with it. Your own classification cannot start until you know. The answer is an AI inventory: one table, one row per AI system, dated. This page gives you the columns, explains why each one is there, and walks through a fictional example so you can see what a finished one looks like.
The Act classifies AI systems (Article 3(1)), not companies. One product can hold a minimal-risk feature, a limited-risk chatbot and a high-risk scoring model at the same time. That is why the inventory has one row per feature, not one row per product.
Why the inventory comes first
For most companies the Act does not require a document called an inventory. It requires things you cannot do without one: a risk classification for each system, a written assessment under Article 6(4) if you rely on the Article 6(3) exemption, a disclosure under Article 50 for each system that talks to people, and AI literacy under Article 4 for the staff who build or use them. Each of those starts from a list of the systems.
It is also the document other people ask for. It answers the first three questions of a typical vendor questionnaire, it is the first row of the data room folder investors expect, and it is where an authority would start if it ever asked.
Two lists, not one
- Systems you provide. Features you ship under your own name. You are their provider under Article 3(3), even when the model underneath is someone else's.
- Systems you deploy. AI tools your team uses: a chat assistant for staff, a meeting note-taker, a CV screening tool. You are their deployer under Article 3(4). This list matters most for Article 4, and for Article 26 if any tool you use is high-risk, such as an AI hiring tool.
Keep both in the same file. A buyer cares about the first list, an authority could ask about both, and Article 4 applies to both.
The columns
| Column | What to write | Why |
|---|---|---|
| System | The feature's name as your team and your customers know it | One row per system |
| Intended purpose | One sentence: what it does, for whom, and what happens with the output | Article 3(12). The tier follows the purpose |
| AI system? | Yes or no, with the reason: does it infer its outputs, or follow rules people wrote? | Article 3(1) |
| Model and model provider | Which model, from whom, called by API or fine-tuned by you | Article 53 stays with the model provider unless you modify the model substantially |
| Your role | Provider or deployer | Articles 3(3), 3(4) and 25 |
| People affected | Who sees the output, and whether it decides or scores anything about a person | Decides most Annex III questions |
| EU link | Placed on the EU market, or output used in the EU | Article 2 |
| Article 5 check | "None", or a note on anything near the line | Prohibited practices, applied since 2 February 2025 |
| Annex III or Annex I | "None", or the point number | Article 6(1) and 6(2) |
| Article 6(3) | Relied on or not; if relied on, the date of the written assessment | Article 6(3) and 6(4). Never available if the system profiles people |
| Article 50 | Which paragraph applies, the wording, and where it appears or how output is marked | Article 50(1) to 50(4) |
| Tier | Prohibited, high, limited or minimal | The summary of the columns before it |
| Next date | The next deadline that applies to this row | Post-Omnibus dates |
| Owner and review date | A named person, and when the row was last checked | Keeps it current |
That looks like a lot, but most rows fill themselves in a minute. A feature with no decisions about people, no Annex III area and no chat interface needs "none" in five columns and is done.
Is it an AI system? The quick test
Article 3(1) defines an AI system as a machine-based system that, with some level of autonomy, infers from its input how to generate outputs such as predictions, content, recommendations or decisions. The word that matters is infers. A model that learned its behaviour from data, including any LLM call, is on the AI side. A routing rule that sends tickets containing "invoice" to billing is a rule a person wrote, and it is not. The Commission's guidelines on the AI system definition work through the borderline cases.
Do not mark a feature "no" because the model is someone else's. A feature that sends text to a third-party model and shows the answer is an AI system, and if it carries your name you are its provider.
A worked example
A fictional helpdesk SaaS with five rows. The product and its features are invented for illustration.
| System | AI? | Role | Tier and reason | Next date |
|---|---|---|---|---|
| Customer-facing support chatbot | Yes | Provider | Limited. Talks to the public: Article 50(1) disclosure in the greeting | Applies now |
| Reply drafts for support agents | Yes | Provider | Limited. Generates text: check who marks output under Article 50(2) | 2 Dec 2026 |
| Keyword ticket routing | No | n/a | Out of scope. Fixed rules written by people | None |
| Agent quality score used in staff reviews | Yes | Provider | High. Annex III point 4: evaluates performance of workers. Profiles people, so Article 6(3) is not available | 2 Dec 2027 |
| Chat assistant used by our own staff | Yes | Deployer | Minimal for this use. Article 4 literacy record | Applies now |
Two things the example shows. The high-risk row is one feature, not the whole product, and it is the row a buyer or investor will ask about first. And the product's biggest live duty, the chatbot disclosure, is a single sentence.
Not sure whether a row sits in Annex III? The free high-risk checker runs the Annex III and Article 6(3) questions for one system in your browser. For the Article 50 column, the Article 50 disclosure generator drafts the wording.
Keeping it alive
- Date the whole table and every row. Deadlines moved with the June 2026 Omnibus, Regulation (EU) 2026/1744. A date shows which version of the rules you assessed against.
- Review on change, not on a calendar. A new feature, a new intended purpose, a new customer segment or a model switch each change a row.
- Send one version. The inventory you attach to a questionnaire, the one in the data room and the one your contracts refer to should be the same document. Inconsistencies are what make reviewers dig.
- Keep the "no" rows. A feature you decided is not an AI system, with the reason, answers the question before it is asked.
An inventory is a record of your own assessment. It is not a certificate, and it should never be described as one. For limited-risk and minimal-risk systems there is no AI Act certificate to get: conformity assessment under Article 43 applies to high-risk systems only.
Each row is one classification. The free scan gives a likely risk tier for one system in about two minutes: eight questions plus your email. A Reglynn gap report turns one row into a dated, referenced position with the role analysis, the Article 6(3) and GPAI checks and the deadlines that apply to your answers; the 3-system and 10-system packs cover more rows. See a sample report. It is a self-assessment, not legal advice.
Frequently asked questions
Is an AI inventory mandatory under the EU AI Act?
For most companies the Act does not require a document called an inventory. It requires a classification per AI system, a written assessment under Article 6(4) if you rely on Article 6(3), Article 50 disclosures and Article 4 AI literacy. An inventory is the practical way to show all of them, and it is what buyers and investors ask for.
Does a feature that calls the OpenAI or Anthropic API count as an AI system?
Yes. A feature that sends input to a model and uses the inferred output is an AI system under Article 3(1). If you ship it under your own name you are its provider under Article 3(3). The model provider keeps the Article 53 duties for the general-purpose model.
How often should an AI inventory be updated?
Whenever something changes a row: a new AI feature, a new intended purpose, a new customer segment or a change of model provider. Date every row, and send the same version to buyers, investors and your contract schedules.
Classify one row in two minutes
The free scan gives a likely risk tier for one AI system: eight questions plus your email. The gap report turns that row into a dated document with the Articles and post-Omnibus deadlines that apply to your answers.
Get your risk tierNo card, no account. Full gap report from €59. See a sample report. Prices exclude VAT, added at checkout where applicable. 14-day refund.
Self-assessment, not legal advice. This page and the Reglynn report are a structured self-assessment based on the EU AI Act (Regulation 2024/1689, as amended by the June 2026 Omnibus). They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.
How this was made. Reglynn reports are generated by an AI system built on Anthropic's Claude and delivered automatically. Reglynn is a Limited Risk AI system under Article 50; we disclose AI involvement wherever it occurs, including in our chat assistant. Our own self-assessment.