Getting started with an AI inventory: a practical first week

By PowerQuant | Updated June 2026 | Reading time: ~7 minutes

Every EU AI Act readiness plan eventually arrives at the same conclusion: nothing else works without an AI inventory. You cannot classify systems you have not listed. You cannot perform Art. 26 deployer duties on systems no one in legal knows are being used. You cannot run an Art. 4 literacy programme for "the people interacting with AI" if you do not know who they are. This article is a practical first-week plan for building that inventory inside a Nordic HR-tech deployer.

Why "just ask IT" doesn't work

The single biggest reason inventories are incomplete is that they are built from the IT asset register alone. Modern HR-tech AI rarely shows up there. It arrives via:

If your inventory pipeline starts from IT's SaaS list, you will systematically miss the last three categories — which are exactly where the highest-risk HR systems tend to live.

Scope it correctly: what counts as "AI"

Use the Act's own definition (Art. 3(1)): a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

The European Commission has published guidance on this definition. In practical scoping terms: if a tool produces a score, ranking, recommendation, classification, generated text, or auto-decision based on inference (rather than a fixed rules engine), treat it as AI for inventory purposes. Borderline cases go in the inventory with a "classification: under review" tag — you can refine later.

The first-week plan

Day 1 — Stand up the schema

Before you collect anything, decide on the fields you will capture per system. A workable starter schema:

A spreadsheet is fine to start. Resist the urge to buy a GRC tool before you have populated the schema; the tool selection should be informed by the inventory, not the other way around.

Day 2 — Run three parallel discovery passes

The three passes will overlap, and that is the point — the systems that appear in only one pass are the ones to scrutinise first. A tool that finance pays for but no one will own is a red flag. A tool that an HRBP describes but IT has never heard of is a bigger one.

Day 3 — De-duplicate and triage

Merge the three lists into a single inventory. For each candidate entry, decide: in scope (AI as defined), out of scope (e.g. a deterministic rules engine), or under review. Tag every Annex III point-4 candidate as high-risk pending validation.

Day 4 — Provider-evidence requests

For every high-risk and under-review system, send the vendor a single, focused evidence request:

Track each request with a deadline. Silence is data — a vendor that cannot answer this in two weeks tells you something about their own readiness.

Day 5 — Classify and gap-list

For each system, complete: provider vs. deployer designation (with Art. 25 reasoning where you customise); Annex III classification with the precise point cited; and a one-paragraph gap statement covering AI literacy coverage, oversight role, worker-information notice, log retention, FRIA requirement, and incident path. Stop here — do not try to solve gaps in the first week. Producing a clean, current, classified inventory is the deliverable; gap remediation is its own track.

Traps to avoid

What "done" looks like at the end of week one

From here, the rest of AI Act readiness — Art. 4 register, Art. 26 procedures, FRIA selection, vendor chasing, Art. 86 explanation paths — becomes mechanical. Everything you build later anchors to the inventory, which is why doing it badly is so expensive and doing it well is so leveraged.

Sources