Is an AI system inventory legally required under the EU AI Act?

Not explicitly as a single document, but effectively yes. The EU AI Act requires providers to maintain technical documentation (Article 11), deployers to implement oversight measures (Article 26), and both to register high-risk systems in the EU database before deployment (Article 49). Providers concluding an Annex III system qualifies for the Article 6(3) exception must also register (Article 6(4)). Meeting all these obligations without a central inventory is impractical.

How do I handle AI systems already in production?

Prioritise by risk level. For any system that may be high-risk or prohibited, initiate an immediate compliance assessment. Document the system, classify it using the decision tree, and begin Annex IV documentation. For limited and minimal-risk systems, add them to the inventory and assess transparency obligations.

Should I include employee-facing AI tools in my inventory?

Yes. The EU AI Act covers AI systems used in the workplace, including HR tools, performance monitoring, and task allocation (Annex III, Category 4). Even purely internal AI tools must be assessed if they make or influence decisions about natural persons.

Shadow AI: Building an AI System Inventory

How to discover shadow AI and build a compliant AI system inventory for the EU AI Act. Covers codebase scanning, risk classification, central register setup, and ongoing governance.

Updated April 6, 2026

Shadow AI refers to AI systems deployed within an organization without formal governance, risk assessment, or compliance oversight. Under the EU AI Act, every AI system that falls within scope must be identified, classified, and documented. You cannot comply with what you cannot see.

Building an AI system inventory is the mandatory first step toward EU AI Act compliance. Article 26(1) requires deployers to assign human oversight measures for high-risk AI systems, which presupposes knowing what AI systems exist. This guide walks you through a practical, developer-friendly approach.

The Shadow AI Problem

60%+

of organizations lack a complete AI system inventory

3-5x

more AI systems than leadership typically estimates

87%

of shadow AI involves third-party APIs or embedded models

What Counts as Shadow AI

Shadow AI is not limited to rogue ML models. Under the EU AI Act's broad definition (Article 3(1)), an AI system includes any machine-based system that operates with varying levels of autonomy and generates outputs such as predictions, recommendations, or decisions.

Third-Party API Integrations

OpenAI, Anthropic, Google, or other AI APIs called from your codebase. Even a single API call to a language model in a customer-facing feature makes your application an AI system under the regulation.

Embedded ML Models

Pre-trained models from Hugging Face, TensorFlow Hub, or PyTorch Hub may be embedded in your application. These may perform classification, NER, sentiment analysis, or content moderation without explicit AI governance.

SaaS Tools with AI Features

Salesforce Einstein, HubSpot AI, Notion AI, GitHub Copilot, and similar tools. If these process data about natural persons in ways that affect decisions, they may require compliance assessment.

Automated Decision Systems

Rule-based systems with ML components, recommendation engines, scoring algorithms, and automated content filtering. If these operate with any level of autonomy and influence decisions about natural persons, they are in scope.

Building Your AI System Inventory: 5 Steps

Scan Your Codebase

Start with automated discovery. Scan all repositories for AI-related imports, API calls, model files, and configuration.

Search for ML framework imports (tensorflow, torch, sklearn, transformers)
Identify AI API calls (openai, anthropic, google.ai, azure.cognitiveservices)
Find model files (.pb, .pt, .onnx, .h5, .pkl, .safetensors)
Detect AI configuration files (model configs, prompt templates)
Scan for embedding and vector database usage (pinecone, weaviate, chromadb)

Survey Teams and Departments

Code scanning catches deployed AI but misses planned, experimental, or SaaS-based AI. Survey every team to identify AI tools not visible in the codebase.

Distribute a structured questionnaire to all engineering, product, and business teams
Ask about AI-powered SaaS tools in use
Identify experimental or proof-of-concept AI projects
Document AI tools used for internal processes (HR screening, customer support, analytics)
Map vendor relationships involving AI or ML services

Classify Each System

For each discovered AI system, determine its risk classification using the EU AI Act framework.

Apply the Article 5 prohibited practices check
Check against all 8 Annex III high-risk categories
Evaluate Article 6(3) exceptions where applicable
Determine GPAI model status (Articles 51-55)
Assess transparency obligations under Article 50
Document the classification rationale for each system

Establish a Central Register

Create a single source of truth for all AI systems. This register serves as the basis for compliance monitoring and regulatory inquiries.

Assign a unique identifier to each AI system
Record the provider, deployer, and responsible person
Document the risk classification with rationale
Track the compliance status of each system
Link to technical documentation (Annex IV) where applicable
Maintain version history and modification records

Implement Ongoing Governance

An inventory is only useful if it stays current. Establish processes to capture new AI systems and flag changes that may affect risk classification.

Add AI inventory checks to your code review and PR process
Require AI system registration before deployment to production
Set up automated scanning in CI/CD to detect new AI dependencies
Schedule quarterly reviews of the inventory with stakeholders
Define escalation paths for newly discovered high-risk AI systems
Train development teams on AI system identification and reporting

AI System Inventory Template

Field	Description	Example
System ID	Unique identifier	AI-SYS-2026-001
System Name	Human-readable name	Customer Support Chatbot
Provider	Organization that developed the system	Internal / Vendor Name
Risk Classification	EU AI Act risk level	High-Risk (Annex III, Cat. 5)
Annex III Category	Applicable category (if high-risk)	Access to Essential Services
Intended Purpose	What the system does	Answers customer queries
Deployment Status	Current lifecycle stage	Production
Data Processed	Types of data handled	Customer messages, account data
Responsible Person	Internal owner for compliance	Jane Smith, VP Engineering
Compliance Status	Current compliance posture	In Progress

Legal Basis for AI System Inventories

While the EU AI Act does not explicitly mandate an AI system inventory as a standalone requirement, several obligations make it a practical necessity for compliance.

Article 26 — Deployer Obligations

Deployers of high-risk AI systems must implement appropriate technical and organisational measures, assign human oversight, and ensure input data is relevant. This requires knowing which AI systems are deployed.

Article 49 — EU Database Registration

Providers of high-risk AI systems must register in the EU database (EUDB) before market placement — not after. Providers who conclude their Annex III system qualifies for the Article 6(3) exception must also register (Article 6(4) + Article 49). Note: law enforcement and migration/border control AI (Annex III points 1, 6, 7) registers in a non-public secure section; critical infrastructure AI (point 2) registers at national level rather than in the EUDB.

Related Guides

AI Risk Decision Tree

Classify each discovered AI system using the interactive decision tree.

Annex III Categories

Deep dive into all 8 high-risk categories with examples.

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.