Updated 17 October 2026. Before asking whether an AI system is ready for a regulatory deadline, ask whether the organisation can find it. An inventory is basic work. Basic does not mean optional.
The original countdown in this article is no longer a current deadline. See the updated AI Act timeline for the distinction between applicable obligations and the later high-risk dates. The argument below concerns inventory design, not a claim that all organisations face one deadline.
Inventory the use, not just the model
A list of model providers is a useful start, but it leaves out the work being done. The same model might summarise public documents in one workflow and help rank applications in another. Those uses deserve separate records because their people, data, permissions and consequences differ.
Start with one live workflow. Give it a recognisable name. Identify its owner and intended purpose. Record who uses it, who is affected, what data it touches and what actions it can take. If nobody can answer a field, mark it unknown and assign someone to investigate.
| Field | Why it matters |
|---|---|
| Purpose and affected people | Makes the use case assessable |
| Owner and supplier | Makes questions routable |
| Data and tools | Shows dependencies and access |
| Permitted actions | Defines the operational boundary |
| Review and change date | Shows whether the record is current |
An inventory needs a change mechanism
A spreadsheet can work for a small estate. The failure is not the spreadsheet. The failure is treating the first completed version as the last one.
Connect the record to the places where systems change: procurement, new integrations, release reviews and retirement. If a team adds a tool that can send messages or update records, the inventory should capture that change in authority. Renaming a feature should not hide it from the people responsible for oversight.
Retirement matters too. A workflow can disappear from the product while its credentials, scheduled jobs or stored data remain. Closing the inventory record should prompt a check of what still exists, rather than merely changing a status cell.
Use it to ask better questions
The inventory is not a compliance certificate. It is a way to make the next assessment possible. The European Commission’s AI Act guidance describes a risk-based framework; applying it requires understanding the actual system and the organisation’s role.
Once the record exists, connect it to the tests supporting the system’s behaviour and the decisions that established its scope. That turns a catalogue into a useful working reference.
Do not wait for a perfect enterprise taxonomy before recording the first system. A clear record with a named owner beats an elegant framework nobody has filled in. The missing spreadsheet will not build itself out of concern.
