AI Inventory and Use-Case Classification

Maintain an inventory of AI systems/use cases and classify them by regulatory role, use, risk category and relevant conditions.

Use an inventory to make AI use visible and route it to the right compliance review; an inventory entry is not itself a legal classification decision.

1. Record each system or use case, its owner, supplier, intended purpose, users, affected people, deployment locations and lifecycle stage.
2. Identify the organization's role for that system and screen for prohibited uses, potentially high-risk uses and relevant general-purpose AI model responsibilities. Do not treat model and system classifications as interchangeable.
3. Route uncertain classifications to the responsible compliance or legal reviewer and link the decision to supporting evidence.
4. Revisit the entry when branding, design, supplier or intended use changes. Include Article 25 role changes and the conditions under which a product manufacturer becomes a provider. Use the inventory to trigger specialist controls; do not interpret a missing tag as an exemption.

At introduction and before release or deployment; when ownership, supplier, branding, design or intended use changes; periodic reconciliation set by the organization.

System inventory with owner, supplier, purpose, role and review date Classification and applicability decisions with supporting sources Approvals or referrals for uncertain use cases Change records showing reassessment after a material change Links from inventory entries to relevant obligations and controls

Compare a sample of procurement, development and business-use records with the inventory. For one changed system, check that the current purpose and regulatory role were reassessed, and that resulting actions reached an accountable owner.