Definition: AI Inventory
An AI inventory is a structured, continuously updated registry of every AI system a company builds, buys, or has in active use, recording the vendor or model behind it, its business purpose, the data it processes, and its risk classification under applicable law.
Core characteristics of AI inventory
An effective AI inventory covers approved deployments and shadow AI alike, since a registry listing only sanctioned tools understates real exposure. It is a living document, updated whenever a system changes, not a one-time audit.
- Covers internally built systems, purchased software with embedded AI, and free-tier tools employees adopt on their own
- Records the vendor, model, data flows, and business owner per entry
- Assigns a risk tier to every listed system
- Feeds directly into governance, procurement, and incident response
AI Inventory vs. AI Bill of Materials
An AI inventory works at the organizational level: which AI systems exist across the company, and who owns each one. An AI Bill of Materials works one level deeper, documenting the models, datasets, and components inside a single system. A company keeps one AI inventory covering dozens of systems, and may keep a separate Bill of Materials for each high-risk system within it. The inventory answers “what AI do we have,” the Bill of Materials answers “what is inside this system.”
Importance of AI inventory in enterprise AI
An AI inventory is the evidence base every other EU AI Act obligation depends on, since risk classification and audit response are impossible for a system nobody has documented. Bitkom research found that 85% of German Mittelstand companies have no documented AI inventory, leaving most SMEs unable to say which systems even require classification review.
Methods and procedures for AI inventory
Building a usable AI inventory follows three sequential steps, from discovery to ongoing maintenance.
Discovery and shadow AI detection
The first step is finding every AI system actually in use, not just the ones IT formally approved. This means combining technical detection with employee outreach, since unauthorized tools leave few traces in procurement records.
- Review SaaS spend and expense reports for AI tool subscriptions
- Analyze network and API logs for traffic to known AI provider endpoints
- Survey employees directly, since usage often surfaces faster through voluntary disclosure than technical monitoring
Classification and documentation
Each system entered into the inventory needs a documented risk tier, an assigned business owner, and a record of the data it processes. Systems in Annex III use cases such as hiring or credit scoring need the fuller documentation trail a high-risk AI system classification demands, while limited-risk tools need only a lighter transparency note.
Maintenance and change tracking
An inventory that is accurate on build day and stale six months later provides no real protection. Mature programs assign an inventory owner, review the registry on a fixed cadence, and require any new AI system, including a vendor update that quietly adds AI capability, to be logged before go-live.
Important KPIs for AI inventory
Tracking inventory health requires metrics distinct from general IT asset management.
Coverage and completeness metrics
- AI system inventory coverage: percentage of AI systems in active use that are documented, target above 95%
- Risk classification completeness: percentage of inventoried systems with a signed-off risk tier
- Detection rate: number of previously unlisted AI tools discovered per quarter
- Time to log: average days between a new AI system going live and its inventory entry being created
Strategic governance metrics
Boards increasingly track inventory completeness as a standalone risk indicator alongside broader AI governance reporting. A 2026 KPMG study of the German AI market found only 37% of companies have clearly defined AI governance responsibilities in place, a gap that shows up first as an incomplete inventory, then as a compliance failure.
Audit readiness metrics
An inventory is only as useful as its ability to answer a regulator’s question quickly. Audit readiness is best measured by how long it takes to produce a complete, current list of AI systems with risk classifications on request, a task that should take hours, not weeks, once the process is mature.
Risk factors and controls for AI inventory
An incomplete or outdated inventory creates specific, recurring risks.
Shadow AI blind spots
Systems employees adopt independently are the most common gap in any inventory, since they bypass procurement entirely. A shadow AI tool processing customer or employee data can create GDPR and EU AI Act exposure long before compliance knows it exists.
- Consumer-tier AI accounts used for company work
- AI features silently enabled inside existing SaaS subscriptions
- Contractor or agency tools that touch company data outside any contract review
Stale or partial documentation
An inventory built once during an initial compliance push and never updated again degrades quickly, since new AI features ship inside existing software on a near-monthly cadence. Vendors frequently add AI capability to products a company already licenses, so the inventory falls out of date without a single new purchase order being raised.
Vendor-held documentation gaps
Many Mittelstand companies rely on third-party AI systems where the technical documentation needed for conformity assessment sits with the vendor, not the company. If a vendor cannot produce it on request, the compliance gap becomes the deploying company’s problem under the EU AI Act, not the vendor’s.
Practical example
A 140-employee specialty chemicals distributor in Lower Saxony began its EU AI Act preparation assuming it ran perhaps five AI tools. A structured discovery exercise combining expense report review, network log analysis, and an anonymous staff survey found 23 systems in active use, including four consumer-tier AI accounts the sales team used to draft customer emails and a demand-forecasting module quietly added to the company’s ERP software during a routine update. The compliance lead built a central inventory covering all 23 systems, assigned a business owner to each, and classified two of them, an AI-assisted credit scoring tool and an automated candidate screening step, as high-risk. The exercise took seven weeks and became the reference document the company now updates every month.
- Central registry covering internally built tools, purchased software, and shadow AI accounts
- Documented business owner and data flow description for every listed system
- Risk classification recorded for each entry with legal sign-off
- Monthly review cadence tied to procurement and IT change management
Current developments and effects
Several developments are pushing AI inventories from a best practice into a documented expectation.
The August 2026 deadline and the Digital Omnibus
The EU AI Act’s general application date of August 2, 2026 brings Article 50 transparency duties and the Act’s broader governance framework into force, even though the Digital Omnibus postponed Annex III high-risk conformity obligations to December 2, 2027. An inventory is what lets a company tell the two timelines apart.
- Article 50 transparency and Article 4 AI literacy obligations remain due from their original dates
- Annex III conformity assessment and technical documentation duties now apply from December 2, 2027
- Companies without a current inventory cannot show which deadline applies to which system
Procurement now demands inventory-ready vendors
Enterprise buyers increasingly require vendors to disclose a system’s risk classification and documentation before signing a contract, pushing inventory discipline upstream into sales. This mirrors the shift already visible around the AI Bill of Materials, where vendors are asked to supply component-level records instead of leaving customers to reconstruct them.
Shadow AI keeps inventories incomplete by default
Gartner projects that by 2030, more than 40% of enterprises will face security or compliance incidents linked to unauthorized AI use, so an inventory covering only IT-approved tools keeps missing the systems most likely to cause a problem. Employee surveys and lightweight detection tooling are becoming a standard part of the inventory process rather than a one-time project.
Conclusion
An AI inventory turns a company’s scattered, partly invisible use of AI into a single accountable record. It is not paperwork for its own sake: it is the document every EU AI Act obligation is built on top of. Mittelstand companies that build one now, ahead of the August 2026 deadline, discover their compliance gaps on their own schedule rather than during a regulator’s first question. Companies that treat the inventory as a living process, not a one-time project, are the ones still confident in their answer a year from now.
Frequently Asked Questions
What is an AI inventory and why does the EU AI Act require one?
An AI inventory is a structured registry of every AI system a company builds, buys, or has in active use, including its risk classification, data flows, and business owner. The Act does not name “AI inventory” as a defined term, but risk classification and human oversight obligations are impossible to fulfill for a system that has never been formally logged.
Does a company with under 250 employees need an AI inventory?
Yes. The duty to classify and document AI systems under the EU AI Act applies based on what a system does, not on company size. A 140-person Mittelstand company running a high-risk hiring tool carries the same classification duty as a large enterprise running the same tool.
How does an AI inventory relate to shadow AI?
Shadow AI, the tools employees adopt without formal approval, is usually the largest gap in an incomplete inventory. A discovery exercise combining expense report review, network monitoring, and employee surveys typically finds more systems in active use than the ones IT originally approved, which is why shadow AI detection is a core inventory-building step, not a separate project.
What does building an AI inventory cost a Mittelstand company?
A first structured inventory for a company running 15 to 30 systems typically takes six to eight weeks and costs a low four to five figure sum in internal time and, where used, external support. Ongoing maintenance costs far less once a review cadence is in place, since new systems get logged as they arrive rather than rediscovered later.
Do we need our own IT team to build and maintain an AI inventory?
No. Most Mittelstand companies combine internal compliance or IT staff with an external partner for the initial discovery and classification work. Companies like Superkind that build custom AI agents on top of a company’s existing systems already document which systems an agent touches, which gives a later inventory effort a documented starting point instead of a blank page.
How long does it take to build a usable AI inventory before the EU AI Act deadline?
A focused first version covering discovery, classification, and documentation can be completed in six to eight weeks, which fits comfortably before the August 2, 2026 general application date if started now. Reaching full maturity, with a fixed review cadence and shadow AI monitoring built into procurement, typically takes another two to three months.
