AI inventory software · EU AI Act & GDPR
As of 3 October 2026 · after the Digital Omnibus
AI Inventory Software: Capture, Classify and Evidence Your AI Systems
An AI inventory often starts as a spreadsheet. Once several departments contribute, reviews fall due and evidence is requested, it becomes a software job. This page shows when switching pays off, which functions AI inventory software should have, how to compare vendors, what it costs – and what it looks like in SimpleAct.
7-day trial (credit card required) · cancel during the trial
- Excel or software? Compared on 13 criteria
- Nine core functions with product views
- Selection checklist with vendor questions
- Prices shown openly, excl. VAT
AI Inventory
3 systems registered
AI-based Application Screening
OpenAI · HR & Recruiting
Service Chatbot "Lia"
Microsoft · Customer Support
Marketing Copy Generator
OpenAI · Marketing
Website Translation Plugin
DeepL
Classify now →In short
What AI inventory software does
AI inventory software is a central record of every AI system in an organisation that goes beyond a list: it captures each system in a structured way, derives the risk class and obligations under the AI Act, assigns owners and review dates, and logs every change so the current state can be evidenced at any time.
The AI Act (Regulation (EU) 2024/1689) does not prescribe a particular tool. It does, however, set obligations that cannot be met without a complete overview: measures on AI literacy (Art. 4), avoiding prohibited practices (Art. 5), classifying high-risk AI (Art. 6), deployer obligations (Art. 26) and transparency obligations (Art. 50). The inventory is the working basis for all of them.
The difference between a list and software is not the columns but the process around them. A spreadsheet shows what someone last entered. Software also shows who changed it and when, which obligations follow, which review is overdue and which evidence is still missing. Those are exactly the questions auditors, customers running supplier audits and works councils ask.
Whether you need software therefore depends less on company size than on the number of systems, the number of people involved and how much evidence you need to produce. For a small, stable estate a well-kept template is enough. The sections below help you draw the line for your organisation.
Excel or software?
Where a spreadsheet is enough – and where it stops
Excel is a good choice for getting started, and our free template is built for exactly that. The limits do not show on day one but after a few months: when several people maintain it, when someone asks how long a classification has applied, or when a review was missed. The comparison shows both sides honestly.
Scroll the table sideways →
| Criterion | Excel spreadsheet | AI inventory software |
|---|---|---|
| Getting started and cost | goodReady immediately, no licence, no IT approval needed. | Licence fee, set-up and a short learning curve; in return a fixed structure from the first entry. |
| Structure and required fields | limitedDropdowns are possible but easily bypassed by copy and paste. | Required fields and fixed value lists; incomplete entries stand out. |
| Risk classification | limitedManual, rationale as free text, result depends on who fills it in. | Guided questionnaire, result with stored rationale, re-assessment traceable. |
| Deriving obligations | hardlyResearch yourself and track in a second list. | Checklist per risk class with article references and a status per obligation. |
| Several editors | hardlyCopies by email, parallel versions, unclear which one is “current”. | One shared data set with roles for editing, reading and approving. |
| Change history | hardlyShows the latest state; the file’s version history cannot be evaluated field by field. | A log per change: who, when, which field, old and new value. |
| Review dates | limitedA date in a column; nobody is reminded, overdue items only show when someone filters. | Due dates per system or document, overdue items shown separately. |
| Approvals | hardlyConfirmation by email outside the file, hard to trace. | Approval workflow with reviewer, status and timestamp on the object. |
| Evidence and documents | limitedLinks to folders that move or go stale. | Evidence attached to the system, completeness at a glance. |
| Finding shadow AI | limitedSurveys and manual matching against licence and purchasing lists. | Depending on the product, analysis of directory services, device management or proxy logs. |
| GDPR link | limitedRoPA or DPIA reference as text, with no check that the entry exists. | Links to RoPA and DPIA, lists of systems where they are missing. |
| Report for auditors | limitedThe file itself; a readable report has to be built by hand. | Report as PDF or DOCX at the push of a button, with date and version. |
| Access control | limitedFile permissions on the drive, no logging of who read what. | Role model, single sign-on and two-factor sign-in depending on product and plan. |
Five signs that Excel is no longer enough
None of these is a legal threshold. They are the points at which spreadsheets start creating work instead of saving it.
- 01
More than about 20 to 30 systems
Count AI features inside existing software too: AI in the office suite, the CRM, the ticketing system, accounting. Many organisations reach this number faster than expected – and the estate grows with every software update.
- 02
More than two or three editors
As soon as departments update their own entries, copies and contradictory versions appear. At that point you need separate rights for reading, editing and approving.
- 03
Someone asks “since when?”
Auditors, customers running supplier audits or the works council want to know when a classification was made and who changed it. A spreadsheet only knows the latest state; the history often matters more than the value.
- 04
Recurring review dates
Annex III high-risk systems are subject to deployer obligations from 2 December 2027, and even uncritical entries should be reviewed at least once a year. Without reminders and an overdue view, dates slip.
- 05
Evidence in one place
Art. 4 training records, DPIAs, DPAs, instructions for use and approvals are scattered. When the inventory only points to other storage locations, it is no longer evidence but a table of contents.
Our rule of thumb: if two of these five signs apply, maintaining the spreadsheet costs more time than software saves. If none applies, stay with the template – and revisit the question in six months.
Just starting out? The free Excel template has 24 columns, dropdowns for risk class, role and status, and three completed example rows.
Get the free Excel templateCore functions
Nine functions AI inventory software needs
This list is meant as a neutral yardstick, not a product description. For each function you will find why you need it, which provision is behind it and how SimpleAct implements it. Select a function to see the matching view from the application.
Every AI system is recorded properly once: name, provider, purpose, affected areas and a responsible person. It matters that the software captures not only in-house builds but also purchased tools and AI features inside existing software. In most organisations these make up the bulk of the estate.
- Required fields instead of free text
- Run internally or bought as SaaS
- Role of the AI: decision-critical or supporting
- Basis
- Basis for Art. 4, 5, 6, 26 and 50 AI Act
- In SimpleAct
- The “Add AI system” form asks for master data, category (internal or external), role of the AI, affected areas and the responsible person.
The biggest risk in an inventory is not the systems someone reports but the ones nobody knows about. Good software helps you find them using data your organisation already produces: app consents in the directory service, the app landscape of managed devices, or proxy and DNS logs. You should be able to decide on each finding instead of importing them blindly.
- Promote, ignore or mark findings as reviewed
- No agent on end devices required
- Discovery itself processes employee data
- Basis
- Completeness of the inventory; GDPR and co-determination for the discovery
- In SimpleAct
- AI Discovery (from Professional) analyses Microsoft Entra ID consents, optionally the Intune app inventory and uploaded network logs (CSV), and matches findings against a vendor catalogue.
The risk class follows from purpose and context: prohibited, high, limited (transparency obligations) or minimal. Software should guide the classification through traceable questions and store the rationale – in an audit, how the result came about matters as much as the result. When the purpose changes, the re-assessment must be just as traceable.
- A questionnaire instead of your own reading of the law
- Annex III category shown with the result
- Rationale and date are kept
- Basis
- Art. 5, 6 and 50, Annex III AI Act
- In SimpleAct
- The guided questionnaire works section by section through high-risk triggers, transparency obligations and deployment context and returns the risk level together with the Annex III category.
A risk class alone does not say what to do. Inventory software should derive the concrete obligations from class and role – provider or deployer – and track each one with an article reference and a status. This is where spreadsheets usually stop: obligations end up in a second document and drift apart.
- Obligations per article, marked fulfilled, partial or open
- Provider and deployer obligations kept apart
- High-risk: Annex IV documentation or Art. 26
- Basis
- Art. 9 to 15, 26, 27 and 50 AI Act
- In SimpleAct
- Compliance checklists are included from Starter. Annex IV documentation for providers or deployer obligations under Art. 26 and, where relevant, the fundamental rights impact assessment (Art. 27) are added from Professional.
Every system needs a person who owns it, and every important document a second person who reviews it. Software should model owner, reviewer, due date and approval as fixed steps and distinguish roles: who may edit, who may only read, who may approve? Otherwise the approval ends up in an email again.
- Roles for administration, editing and read access
- Status draft, in review or final
- Overdue reviews visible rather than hidden
- Basis
- Art. 26 AI Act (oversight, responsibilities); accountability under Art. 5(2) GDPR
- In SimpleAct
- Admin, Editor and Viewer roles in every plan; governance workflows with owner, reviewer, due date and approval from Professional. Only admins in the governance admin pool can approve.
Evidence is only worth as much as the answer to whether it was altered afterwards. The software should record every change field by field – person, time, old and new value – without users having to think about it. Ideally, the log’s integrity can be verified technically.
- Who, when, what – including old and new value
- Failed attempts are logged too
- An integrity check instead of trust
- Basis
- Evidence and accountability duties under the AI Act and GDPR
- In SimpleAct
- The audit trail is included in every plan and built as a hash chain: each entry seals its predecessor, and integrity can be checked per record or for the whole organisation.
Sooner or later someone without access to the software wants to see the inventory: management, the statutory auditor, a supervisory authority or a customer. That calls for readable reports with date and version – and, separately, a complete machine-readable export so your data is not tied to one vendor.
- Report as PDF or DOCX with versioning
- Choose which systems and documents are included
- Data export at contract end set out in the contract
- Basis
- Duties to present information to authorities; data portability
- In SimpleAct
- Reporting from Starter (PDF and DOCX with versioning), register export from Professional. After contract end, the terms make the data available for 30 days in a common format (e.g. CSV, JSON, PDF).
Almost every AI system in day-to-day office use processes personal data. It then also belongs in the records of processing, and a high risk calls for a data protection impact assessment. Good software connects both worlds instead of keeping two separate lists – and shows where the link is still missing.
- Link an AI system to a RoPA entry
- List: systems without a RoPA entry
- DPIA on the system, with risks, measures and approval
- Basis
- Art. 28, 30 and 35 GDPR
- In SimpleAct
- The GDPR module (from Professional) covers records of processing, DPIA, TOMs and DPA. Dedicated views list AI systems without a RoPA entry and high-risk or personal-data systems without a DPIA.
The larger the organisation, the more it matters that inventory software fits the existing IT: sign-in via the existing directory, automated user management, a documented API for your own reporting. Ask specifically about protocols and which plan they are included in.
- Single sign-on via common protocols
- User provisioning from the directory
- API and webhooks for your own processes
- Basis
- IT security and operations; not an AI Act obligation
- In SimpleAct
- Single sign-on via OIDC, SAML and LDAP from Professional; SCIM provisioning, REST API and webhooks in the Enterprise plan.
01Structured capture
Add AI system
New inventory record
Master data
Step 1 of 2How it works in SimpleAct
From the first entry to audit-ready evidence
The views below come from the application and show the flow with the demo tenant’s sample data. Four steps that build on each other – each step uses the information from the previous one instead of asking for it again.
- Step 01
Capture systems
You add each AI system with its master data: name, provider, purpose, run internally or bought as SaaS, role of the AI and affected areas. A responsible person takes ownership. Systems found by AI Discovery sit alongside and can be adopted directly.
- Form with required fields
- A responsible person per system
- Adopt findings from shadow-AI discovery
app.simpleact.deAdd AI system
New inventory record
ENAMaster data
Step 1 of 2CategoryInternalExternal (SaaS)Role of the AIDecision-criticalSupportingAffected areasSalesMarketingResponsible personThomas Müllert.mueller@demo-org.deOrganisation: Demo Organisation GmbHSave & assess - Step 02
Classify the risk
A guided questionnaire works out, section by section, whether high-risk triggers are present, transparency obligations apply and in which context the system is used. The result is the risk level with its Annex III category – and below it the requirements per article with their status.
- Yes/no questions instead of legal text
- Risk level with Annex III category
- Requirements per article: fulfilled, partial, open
app.simpleact.deRisk Classification
AI-based Application Screening
ENASelect systemAnswer questionsResultSection A: High-risk triggers
18/21 answered2Does the system make or influence decisions about natural persons?
YesNo3Does the outcome have legal or similarly significant effect?
YesNo4Are special categories of personal data processed?
YesNoRisk level
High
Annex III · Employment & workforce management
Requirements
- Risk management systemArt. 9 EU AI ActFulfilled
- Data governanceArt. 10 EU AI ActPartial
- Human oversightArt. 14 EU AI ActMissing
- Step 03
Settle ownership and approval
For risk assessment, documentation and checklist it is set who owns it, who reviews it and by when. Every object runs the same path from draft through review to final. The tiles at the top show what sits in review and where a due date has passed.
- Owner, reviewer, due date, approval
- Status draft, in review, final
- Overdue first
app.simpleact.deGovernance Hub
Owners, reviews and evidence per object
ENAWorkflows12
In review3
Overdue1
Evidence28
RISK_ASSESSMENT
AI-based Application Screening
4/4 checks doneFINALOwnerReviewerDue dateApprovalANNEX_IV_DOSSIER
Service Chatbot "Lia"
3/4 checks doneIN REVIEWOwnerReviewerDue dateApprovalCOMPLIANCE_CHECKLIST
Marketing Copy Generator
1/4 checks doneDRAFTOwnerReviewerDue dateApproval - Step 04
Evidence and export
Every change lands in the audit log without anyone doing anything. A readiness figure shows what share of the evidence is complete, partial or missing. Reports can be issued as PDF or DOCX – for management, auditors or customers.
- Log of who, when, what
- Completeness of evidence
- Export at the push of a button
app.simpleact.deAudit Log & Export
247 of 312 entries
ENAAudit readiness
Audit-readyComplete
Partial
Missing
Export PDFEU Declaration of Conformity (Art. 47)
PDF · DE/EN · incl. audit history
Action Entity Event UPDATE Risk Assessment Re-assessment completed A. Schmidt 2026-08-18 CREATE Evidence Evidence "DPIA report" added T. Müller 2026-08-15 UPDATE Governance Approved by reviewer L. Weber 2026-08-11 CREATE AI System System "Chatbot Lia" created A. Schmidt 2026-08-02
Selection checklist
The questions to ask vendors
Tick what matters to you. On the right, the matching question list for demos and tenders builds up – worded neutrally, usable with any vendor. One click copies it into an email, ticket or scoring matrix.
Questions for vendors
For demos, quotes or tenders
Select at least one requirement on the left.
The list runs entirely in your browser; nothing is stored or sent.
Evaluation criteria
What to look for when choosing
Any demo can show features. The differences often lie in points that only surface at contract, roll-out or audit. For each criterion the table says what matters, how to check it and which answer is a warning sign.
Scroll the table sideways →
| Criterion | What matters | How to check | Warning sign |
|---|---|---|---|
| Hosting and data location | The inventory holds purposes, owners and often hints at personal-data processing – sensitive business information. | Have the country and operator of application, database and backups named in writing. | “Cloud in Europe” without a named operator or location. |
| GDPR and DPA | The vendor of the inventory software is itself a processor under Art. 28 GDPR. | Read the DPA and the list of subprocessors before signing. | DPA only after signature or only on request. |
| Role model | Departments should maintain but not approve; auditors should read but not change anything. | Ask for a read-only user to be created in the demo and check what it sees. | Only “admin” and “user”, no separate approval. |
| Audit trail | Evidence must show who changed what and when – and that nothing was altered afterwards. | Make a change and ask to see the log line with old and new value. | Only “last modified on” without the content of the change. |
| Exports and exit | Reports for auditors and a complete data export protect against lock-in. | Have a report and a raw-data export generated; read the contract-end rules in the terms. | Export only as image PDF or only for an extra fee. |
| Pricing model | The estate grows; what is cheap today can be expensive at 50 systems or 20 users. | Ask for the price today and for double the systems and users. | Prices on request only, even for standard plans. |
| Onboarding effort | The biggest cost is usually internal time for capture and coordination, not the licence. | Ask how long capturing ten typical systems takes and who helps. | Mandatory consulting package before first use. |
| Legal status of the logic | The AI Act was already amended by the Digital Omnibus in 2026; more guidelines will follow. | Ask when the last legal update was made and how customers learn about it. | Outdated dates, e.g. high-risk obligations “from August 2026”. |
| Privacy of discovery | Shadow-AI discovery evaluates who uses which tools – that is employee data and often subject to co-determination. | Ask which personal data is stored and for how long. | Full user lists per tool without any limit. |
The criteria apply to any AI inventory software, SimpleAct included. A structured comparison of several solutions is on our AI Act software comparison page. To the comparison →
Cost
What AI inventory software costs
Prices for AI inventory software range from simple registers to platforms with governance, data protection and integrations. We show our prices openly – so you can compare them with other offers and with the internal effort of a spreadsheet.
Starter
For small businesses and first AI governance processes
€199/month
€159 per month billed annually
- Up to 5 AI systems & 3 users
- AI inventory and risk classification
- Compliance checklists
- Reporting
Professional
For multiple teams and real governance requirements
€349/month
€279 per month billed annually
- Everything in Starter
- Unlimited AI systems and users
- Annex IV documentation or deployer obligations under Art. 26
- Vendor register and model registry
- AI Discovery: find shadow AI
- Governance workflows and audit readiness score
- Single sign-on: OIDC, SAML and LDAP
- Register export
- GDPR module: RoPA, DPIA, TOMs and DPA
Enterprise
For complex compliance, governance and security requirements
On request
- Everything in Professional
- SCIM provisioning
- REST API and webhooks
- Custom integrations and priority support
- Onboarding workshops and custom SLAs
All prices excl. VAT. 7 days free with the full Starter scope. The trial requires a credit card: unless you cancel, the Starter subscription continues afterwards, and we remind you of the amount due 3 days before. Cancel any time during the trial. You can upgrade to Professional at any time.
All prices and featuresWhat drives the cost
- Number of AI systemsMany vendors tier by systems. Count realistically, including AI features inside existing software, and allow for growth.
- Number of usersDo two people maintain the inventory, or every department? That often decides the plan tier.
- ModulesInventory only, or also governance workflows, a GDPR module, discovery and integrations? One plan covering both can be cheaper than two tools.
- Internal effortCapture, coordination with departments and maintenance take working time – with or without software. Software mainly shortens ongoing maintenance and audit preparation.
Security and data protection
Where your inventory data lives
An AI inventory describes how your organisation uses AI – that is confidential. Hosting, contracts and access control therefore belong in every selection decision. This is how SimpleAct handles them.
Hosted in Germany
The application and the self-managed PostgreSQL database run at Hetzner in Nuremberg, backups in Falkenstein. No US or other non-European cloud providers are used for hosting or the database. Exception: if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA.
ISO 27001 data centre
Hosting is in an ISO 27001-certified Hetzner data centre. The certification applies to the data centre; SimpleAct’s own technical and organisational measures are described in the security whitepaper.
Encryption
All data is encrypted in transit (TLS) and at rest.
DPA and subprocessors open
The data processing agreement under Art. 28 GDPR can be read in full in advance. The subprocessors Hetzner, Stripe, Brevo and Anthropic (only if the AI assistant is switched on) are listed there with registered office, purpose and processing location.
Roles and sign-in
Admin, Editor and Viewer roles with separate rights; admins can set up two-factor sign-in. Single sign-on via OIDC, SAML and LDAP from Professional.
Tamper-evident log
The audit trail is built as a hash chain. You can check yourself whether an entry was altered afterwards – per record or for the whole organisation.
SimpleAct itself does not hold an ISO 27001 certification; the certification applies to the hosting provider’s data centre.
Legal framework
Which obligations build on the AI inventory
The AI Act does not prescribe an internal AI inventory as a document of its own. The obligations below, however, assume you know which systems you use and for what. The table shows which entry in the inventory supports which obligation.
Scroll the table sideways →
| Provision | What it is about | What the inventory must provide | Applies from |
|---|---|---|---|
| Art. 4 AI Act | AI literacy: providers and deployers take measures to support the development of AI literacy among their staff and persons acting on their behalf (as reworded by the Digital Omnibus). | Which groups use which systems – that tells you who needs which training or briefing. | 2 Feb 2025 |
| Art. 5 AI Act | Prohibited practices, such as social scoring or emotion recognition in the workplace. | The concrete purpose of each system, so it is checked once against the prohibitions. | 2 Feb 2025 |
| Art. 6 with Annex III | Classification as high-risk AI, e.g. in recruitment, creditworthiness or education. | Risk class with rationale and, where relevant, the Annex III category. | 2 Dec 2027 |
| Art. 6 with Annex I | High-risk AI as a safety component of regulated products, such as machinery or medical devices. | Link to the product and the applicable harmonisation legislation. | 2 Aug 2028 |
| Art. 26 AI Act | Obligations of deployers of high-risk AI: use according to instructions, human oversight, keeping logs, informing affected persons. | Owner, oversight person, where the instructions for use are kept, and review dates. | 2 Dec 2027 (Annex III) |
| Art. 49 and 71 AI Act | EU database: providers register Annex III systems; deployers that are public authorities or bodies register their use. | Flag whether registration is required and whether it has been done. | with the high-risk obligations |
| Art. 50 AI Act | Transparency: notice for chatbots, marking of synthetic content and deepfakes. For para. 2, systems placed on the market before 2 Aug 2026 have a transition period until 2 Dec 2026. | Whether a system interacts with people or generates content – and which notice is shown where. | 2 Aug 2026 |
| Art. 30 GDPR | Records of processing activities (RoPA). | Reference to the RoPA entry once an AI system processes personal data. | already applies |
| Art. 35 GDPR | Data protection impact assessment where processing is likely to result in a high risk. | Reference to the DPIA, e.g. for profiling, automated scoring or monitoring. | already applies |
| Art. 28 GDPR | Data processing agreement with service providers that process personal data. | Whether a DPA exists with the AI vendor – and with the vendor of the inventory software itself. | already applies |
Dates under Regulation (EU) 2024/1689 as amended by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. Simplified; the wording in the Official Journal is authoritative.
FAQ
Frequently asked questions about AI inventory software
More questions? We're happy to help. Send email · Try 7 days (credit card required)
Sources and status
Last reviewed on · SimpleAct editorial team
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
This page is meant as guidance for choosing software and is not legal advice. The wording in the Official Journal of the EU is authoritative. Product details refer to the date above.
Changes to this page
- 10 October 2026 – Art. 4 in the Omnibus wording.
- 3 October 2026 – Rebuilt: Excel vs. software comparison, core functions with product views, selection checklist with vendor questions, evaluation criteria, prices and dates after the Digital Omnibus.
- 16 June 2026 – First version.
Further reading
- AI register template (Excel, free)
- AI register: definition and required fields
- AI Act software compared
- EU AI Act deadlines after the Digital Omnibus
- AI risk classification
- SimpleAct at a glance
- SCIM provisioning from Entra ID or Okta (Enterprise)
- MLflow: bring model versions into the model registry (Enterprise)
Build your AI inventory in SimpleAct
Capture your AI systems, classify the risk and keep owners, review dates and evidence in one place – hosted in Germany.