Free template · Excel

As of 3 October 2026 · after the Digital Omnibus

AI Register & AI Inventory Template (Excel, free)

One spreadsheet listing every AI system in your organisation with its purpose, role, risk class and owner – that is the basis for almost every obligation under the AI Act. Download our Excel template here: 24 columns, dropdowns for risk class, role and status, three completed example rows and a guide. No email address required.

Download Excel template Book a demo

XLSX · 32 KB · no sign-up

Dropdowns for risk class, role, status
3 example rows + guide
Frozen header, filters on

app.simpleact.de

AI register

Demo Organisation GmbH · template preview

SimpleAct_AI_Register_Template_EN.xlsx Filter

1AI systemRisk class

2Microsoft 365 CopilotMinimal

3Applicant screening toolHigh-risk

4Customer service chatbotTransparency

5…

3 example rows · 300 empty rows with dropdowns

Basics

What an AI register is – and why you need one

An AI register, often called an AI inventory, is a central list of every AI system your organisation uses, develops or offers. For each system it records what it is used for, who owns it, which data goes in, whom the outputs affect and which risk class of the AI Act it falls into.

To be precise: the AI Act (Regulation (EU) 2024/1689) does not explicitly require a general "AI register". But it ties almost every obligation to the individual system and its purpose. Which AI literacy measures make sense (Art. 4), whether a prohibited practice is involved (Art. 5), whether a system is high-risk (Art. 6 and Annex III), which deployer obligations apply (Art. 26) and where a transparency notice is needed (Art. 50) – you can only answer these questions if you know which systems are in use at all.

The register is therefore not an end in itself but your working basis: it shows where action is needed and serves as evidence that you have dealt with your AI use systematically. When a supervisory authority, a customer running a supplier audit or the works council asks which AI is in use, the answer is in one file.

The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) moved some deadlines: the obligations for high-risk AI under Annex III only apply from 2 December 2027. Other obligations have been running for a while – the Art. 5 prohibitions since February 2025, the Art. 50 transparency obligations since August 2026. Art. 4 was reworded: organisations must take measures to promote AI literacy rather than ensure a specific level. For all of these, the register is the starting point.

Preview

What the completed template looks like

Below are all columns of the Excel file with four example rows for a fictitious "Demo Organisation GmbH". The values are plausible examples, not a legal assessment of the products named – the classification always depends on how your organisation actually uses them.

Example data · Demo Organisation GmbH · not legal advice Core fieldScroll the table sideways →

What the completed template looks like
ID	AI system / tool	Vendor / supplier	Department	Intended purpose	Role	User group	Affected persons	Personal data	Input data	Risk class	Rationale	Annex III area	Transparency (Art. 50)	Human oversight	Owner	Status	AI literacy	RoPA / DPIA	DPA / contract	In use since	Last review	Next review	Notes
AI-001Example	ChatGPT Team	OpenAI	Marketing	Drafts for blog posts, social media copy and translations	Deployer	8 people	No decisions about people	No	Public product info, internal briefs without personal data	Minimal	Text generation without an Annex III purpose. For published texts on matters of public interest without editorial review, check Art. 50(4).	No Annex III area	To be checked	Editors review before publishing	Head of Marketing	Approved	Done	–	In place	01/02/2025	15/09/2026	15/09/2027	Policy: no customer data
AI-002Example	Microsoft 365 Copilot	Microsoft	All departments	Summarise emails and meetings, draft text in Word and Outlook	Deployer	approx. 120 people	Staff, customers (in emails)	Yes	Emails, chats, documents in the tenant	Minimal	General office assistance, no decisions about people, no Annex III purpose.	No Annex III area	Not applicable	Users review every draft	Head of IT	Approved	Partly	RoPA-014	In place	01/03/2025	15/09/2026	15/03/2027	Works council involved
AI-003Example	Applicant screening tool	Example HR software vendor	HR	Rank applications by fit, suggest interviews	Deployer	6 recruiters	Applicants	Yes	CVs, cover letters, references	High-risk	Selecting applicants falls under Annex III No. 4. Deployer duties under Art. 26 from 2 December 2027.	No. 4 Employment	Not applicable	Recruiters decide, no automatic rejections	Head of HR	Under review	Open	RoPA-021 / DPIA-003	In place	15/01/2026	20/09/2026	20/12/2026	Request instructions for use
AI-004Example	Customer service chatbot	In-house build on a language model	Customer service	Answer questions on delivery status and returns	Provider	Service team (maintenance)	Customers	Yes	Order number, chat history	Transparency	Interacts directly with people: AI notice under Art. 50(1). No Annex III purpose.	No Annex III area	Yes – AI interaction	Hand-over to staff on request	Head of Customer Service	Pilot	Done	RoPA-030	In place	01/06/2026	01/09/2026	01/03/2027	Notice in the chat window

Download Excel templateXLSX · 32 KB · no sign-up

Fields

Core fields and extra fields – what really has to go in

Not every field matters equally for every system. Fill in the 13 core fields for every AI system, even the small translation tool. The extra fields become relevant as soon as personal data is processed, people interact directly with the AI or an Annex III area is touched.

Field	Type	Why it belongs in the template	Legal reference
ID	Core field	Unique identifier that stays the same even if the name changes. Lets contracts, tickets and the RoPA refer to it.	–
AI system / tool	Core field	Product or project name, with licence or version if useful.	Art. 3(1) AI Act
Vendor / supplier	Core field	Shows who provides instructions for use, documentation and updates.	Art. 25 AI Act
Department	Core field	Assigns the system to a business unit and makes contacts visible.	–
Intended purpose	Core field	The purpose decides the risk class – not the product. The same tool can be minimal or high-risk depending on use.	Art. 6, Annex III AI Act
Role	Core field	Deployers and providers have very different obligations. Offering a system under your own name makes you a provider.	Art. 3(3) and (4) AI Act
User group	Extra field	Basis for targeted training and briefings.	Art. 4 AI Act
Affected persons	Core field	Shows whether decisions about people are made – a key indicator for high-risk and for information duties.	Art. 26, 27 AI Act
Personal data	Core field	Bridges to the GDPR: RoPA entry, processing agreement, possibly an impact assessment.	Art. 30 GDPR
Input data	Extra field	Shows which information leaves the organisation and how relevant and representative the inputs are.	Art. 26 AI Act, Art. 5 GDPR
Risk class	Core field	Prohibited, high-risk, transparency obligation or minimal. New entries start as "Not yet assessed".	Art. 5, 6, 50 AI Act
Rationale	Core field	The classification must be traceable. Using the Art. 6(3) exemption requires documenting it.	Art. 6(3) and (4) AI Act
Annex III area	Extra field	The eight Annex III areas are the most common source of high-risk cases in organisations.	Annex III AI Act
Transparency (Art. 50)	Extra field	Chatbots, generated content and deepfakes need notices or marking – since 2 August 2026.	Art. 50 AI Act
Human oversight	Extra field	Describes who checks outputs before they take effect. A deployer duty for high-risk AI.	Art. 14, 26 AI Act
Owner	Core field	Without a named person every entry goes stale. A role will do, a name is better.	–
Status	Core field	From "idea / request" to "retired" – so you also see planned and rejected tools.	–
AI literacy	Extra field	Records whether users have been trained or briefed – the practical evidence for Art. 4.	Art. 4 AI Act (amended)
RoPA / DPIA	Extra field	Links the record of processing activities and impact assessment so AI and privacy documentation match.	Art. 30, 35 GDPR
DPA / contract	Extra field	Reveals gaps in processing agreements and terms of use.	Art. 28 GDPR
In use since	Extra field	Relevant for transitional rules on systems that went live before a deadline.	Art. 111 AI Act
Last review	Core field	Shows the register is maintained.	–
Next review	Core field	Schedules the follow-up – within twelve months at the latest, sooner for critical systems.	–
Notes	Extra field	Open questions, decisions, links to documentation.	–

"Core" is our recommendation for a robust register, not a requirement of the Regulation. The AI Act does not prescribe a fixed format.

How-to

Fill in the AI register in 6 steps

How to get from an empty spreadsheet to a register you can show an auditor. For a mid-sized organisation with 10 to 30 tools this usually takes two to four weeks alongside other work.

Agree ownership and scope
Decide who maintains the register – often IT, compliance or data protection – and who contributes from the business units. Define what counts as an AI system: when in doubt, capture more. AI features built into existing software count too.
Outcome: Owner named, definition agreed
Collect the systems
Use several sources: purchasing and licence lists, single sign-on and browser extension overviews, firewall or proxy logs and a short survey in every department. Don’t ask "Do you use AI?" but "Which tools write, translate, summarise or score things for you?"
Outcome: Raw list of candidates
One row per intended purpose
Fill in the core fields. If a tool is used for clearly different purposes – say a language model in marketing and in recruiting – create two rows. The risk class follows the purpose, not the product.
Outcome: Register with core fields
Provisionally classify the risk
Check in this order: is a prohibited practice under Art. 5 involved? Does the purpose fall under Annex III, or is the system part of a regulated product? Are there transparency obligations under Art. 50? Otherwise: minimal. Add a one- or two-sentence rationale. Unclear cases stay "Not yet assessed" and get a short review date.
Outcome: Risk class with rationale
Derive obligations and measures
Every row leads to something: training or briefing for the user group (Art. 4), a notice for the chatbot (Art. 50), instructions for use and human oversight for high-risk systems (Art. 26), a RoPA entry and a DPA for personal data. Record open items in "Notes" or link your ticket system.
Outcome: Measures per system
Sign off and schedule reviews
Have management or the relevant committee acknowledge the register and set a "Next review" date for each row. From now on: no new AI tool without a row in the register – easiest if purchasing and IT approval require the entry.
Outcome: Approved register with review dates

Interactive

Build a register row live

Describe an AI tool in four answers. On the right, the matching register entry appears with a rough risk classification and next steps – ready to copy into the Excel template.

Tool nameDepartment

Your role

What is it used for?

Personal data?

app.simpleact.de

New register entry

Preview · columns as in the Excel template

New AI tool

Marketing · Deployer

What is it used for?

Rough guidance based on your answers, not legal advice. The binding classification depends on the specific system and use.

In practice

10 typical AI tools in organisations – and how they are often classified

These tools show up in almost every register. The classification is a typical starting point, not an assessment of the product: what counts is what your organisation uses it for.

Tool / category	Typical role	Common classification	What to watch
ChatGPT, Claude, Gemini (chat)	Deployer	usually minimal	Depends on use: if it is used to evaluate applicants or people, the classification changes. Set usage rules and train staff.
Microsoft 365 Copilot	Deployer	usually minimal	Access to all data in the tenant – permissions, RoPA and works council are the real issues.
DeepL and other translators	Deployer	minimal	Check whether confidential or personal texts are translated and which licence covers that.
GitHub Copilot, code assistants	Deployer	minimal	Licence and source code questions, handling secrets in code.
Image generators (e.g. Midjourney)	Deployer	often transparency	Published deepfakes must be disclosed (Art. 50(4)).
Meeting assistants / transcription	Deployer	usually minimal	Features analysing employees’ mood or emotions are prohibited under Art. 5 – switch them off.
Website chatbot	Deployer or provider	transparency	AI interaction notice. Building the bot under your own name can make you a provider.
Applicant tracking with AI ranking	Deployer	often high-risk	Annex III No. 4. Deployer duties from 2 December 2027; preparing now pays off.
Lead scoring in the CRM	Deployer	usually minimal	Scores sales opportunities, not access to essential services – still check GDPR profiling.
Credit or creditworthiness scoring	Deployer	high-risk for natural persons	Annex III No. 5. Pure fraud detection is excluded.

Simplified overview, not legal advice. "Often" means: in typical use – your specific use may need a different assessment.

Maintenance

When the register needs updating

A register that is created once and then forgotten is worthless after six months. Fixed triggers keep it current:

01
New tool or licence
Every purchase, every trial and every AI feature switched on in existing software gets a row – before it goes live.
02
New purpose
If a tool is suddenly used for HR decisions or with customers, the risk class may change. Better to add a second row.
03
Major update
New models, new data sources or more automation from the vendor: review the classification rationale.
04
Incident or complaint
Wrong decisions, data leaks or complaints from affected people are a reason to review the entry and the human oversight.
05
Legal change
New Commission guidelines, changes such as the Digital Omnibus or new dates – e.g. 2 December 2027 for Annex III.
06
Retirement
Don’t delete tools, set them to "Retired". That way it stays traceable what was in use when.

Regular rhythm

On top of the triggers, a full review at least once a year is advisable, quarterly for high-risk and unclear entries. The "Last review" and "Next review" columns make this visible – the filter finds overdue entries in seconds.

Distinction

Internal register vs. EU database

The AI Act provides for a public EU database for high-risk AI (Art. 71). That is different from your internal register – the two are often confused.

Aspect	Internal AI register	EU database (Art. 49, 71)
Who keeps it?	Your organisation	The European Commission
What is recorded?	All AI systems, including minimal risk	Only high-risk AI under Annex III (and systems using the Art. 6(3) exemption)
Who enters data?	Internal owners	Providers before placing on the market; deployers that are public authorities, for their use
Visibility	Internal, on request for auditors	Largely public
Legal basis	No explicit obligation – practical basis for Art. 4, 5, 26, 50	Explicit registration obligation

For most organisations using AI as deployers, the internal register is all they need. Registration in the EU database mainly concerns providers of high-risk systems and public bodies.

Shadow AI

Finding shadow AI: the tools nobody reported

In almost every organisation, staff use AI tools that were never officially introduced – usually for good reasons, but without review. A register that only lists known licences is incomplete. How to find the rest:

Short, no-blame survey
Ask every department about concrete tasks instead of "AI". Make clear it is about the overview, not sanctions – otherwise you will get no answers.
Credit card and expense reports
Small monthly subscriptions to AI services often run on personal or company cards, bypassing IT.
SSO, browser extensions and OAuth grants
Many tools sign in via "Sign in with Microsoft/Google" or run as browser plug-ins. Identity and endpoint management overviews show them.
Network and proxy logs
Traffic to known AI domains gives an idea of scale and departments – evaluated in line with data protection and agreed with the works council.
AI features in existing software
CRM, ticketing, office suite and HR software have often added AI features. Check release notes and admin settings.

Limits

Is Excel enough? Where the template shines – and where it doesn’t

For getting started, a spreadsheet is often exactly right: fast, familiar, no procurement. As the number of systems and people grows, it hits its limits.

Manageable up to about 20–30 systems
Ready immediately, no IT approval needed
Easy to share and export
Dropdowns keep values consistent

No history

Who changed the risk class, when and why? Excel only shows the latest state – for evidence, the change history often matters more than the value itself.

No reminders

Review dates sit in a column, but nobody gets reminded. Overdue entries only surface when someone filters.

Versions and access

Copies by email, parallel editing, no role model: after a few months there are several "current" versions.

No links

Training records, documentation, contracts and RoPA live elsewhere. The register only points to them.

When you hit these limits, SimpleAct takes over the same structure as software: AI inventory with risk classification, owners, reminders, audit history and export.

See the AI inventory in SimpleAct

Open-Source Framework

simpleact-ai-system-inventory

Open-source AI system inventory template: structured capture of all AI systems with mandatory fields per the EU AI Act.

View on GitHub

FAQ

Frequently asked questions about the AI register

Not explicitly. The AI Act (Regulation (EU) 2024/1689) does not prescribe a general internal "AI register" in a specific format. But it sets obligations you can hardly meet without an overview of your AI systems: measures on AI literacy (Art. 4), avoiding prohibited practices (Art. 5), classifying high-risk AI (Art. 6), deployer obligations (Art. 26) and transparency obligations (Art. 50). The register is the practical basis for these – and the simplest evidence that you have dealt with them.

Yes, we recommend it. Even if these tools usually pose no high risk in typical office use, Art. 4 (AI literacy) and Art. 5 (prohibitions) apply to every AI system. They also often process personal data, which triggers GDPR obligations. And the classification depends on the purpose: if someone uses ChatGPT to evaluate applications, an uncritical entry quickly becomes an Annex III case.

The Regulation sets no rhythm. What works: event-driven for every new tool, new purpose, major update or incident – plus a full review at least once a year, quarterly for high-risk and unclear entries. The "Last review" and "Next review" columns in the template make this traceable.

You decide. Often a central function keeps the register – compliance, IT, data protection or an AI officer – while each department contributes its entries and a responsible person is named per system. What matters is that both are clearly defined; as with other compliance topics, overall responsibility lies with management.

For getting started and for smaller inventories, yes. The AI Act does not prescribe a tool. What matters is complete, traceable and current content. Excel reaches its limits when many people contribute, a change history is needed or review dates should be tracked automatically – then software pays off.

AI register and AI inventory mean the same in practice: a list of all AI systems with purpose, role, risk class and owner. The record of processing activities (RoPA) under Art. 30 GDPR is something else: it describes processing of personal data, whether or not AI is involved. The two overlap when an AI system processes personal data – which is why the template has a column for the RoPA reference.

No, you do not submit the internal register. Distinct from it is the EU database under Art. 71: providers register their Annex III high-risk systems there before placing them on the market, and public authorities as deployers register their use (Art. 49). You should, however, be able to show your internal register if a supervisory authority asks.

Yes. You can add or remove columns, extend dropdown values on the "Lists" sheet and use the file freely within your organisation. The template is a working aid and not legal advice.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

Last reviewed on 10 October 2026 · SimpleAct editorial team

This page and the template are for orientation and are not legal advice. The wording in the Official Journal of the EU is authoritative.

Changes to this page

10 October 2026 – Art. 4 in the Omnibus wording (AI literacy measures).
3 October 2026 – Rebuilt: free Excel template with dropdowns and example rows, full preview, field overview with legal references, register row builder, status after the Digital Omnibus.
23 May 2026 – First version with PDF template.

From register to compliance in practice

SimpleAct keeps your AI inventory with risk classification, owners, deadlines and audit history – and reminds you when a review is due.

Book a demo Try 7 days (credit card required)

AI Register & AI Inventory Template (Excel, free)

What an AI register is – and why you need one

What the completed template looks like

Core fields and extra fields – what really has to go in

Fill in the AI register in 6 steps

Agree ownership and scope

Collect the systems

One row per intended purpose

Provisionally classify the risk

Derive obligations and measures

Sign off and schedule reviews

Build a register row live

10 typical AI tools in organisations – and how they are often classified

When the register needs updating

New tool or licence

New purpose

Major update

Incident or complaint

Legal change

Retirement