AI System & Use Case Inventory

Records AI systems in use with owner, purpose, data processed, provider and risk classification.

Available soon

Format: Excel
Size: 143 KB
Length: 10 sheets
Version: 1.1
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.114 Oct 2026
Check IV-10 asks for a contract term that bars training for Internal data as well as Confidential, as the information classification standard's CL-19 requires; a setting verified off is no longer enough on its own. The example's warehouse forecasting module now has that term.
1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this workbook is. It is the inventory of AG-10 in AI Acceptable Use & Security Policy: one row for each AI use, sixteen fields (IF-01 to IF-16), ten checks (IV-01 to IV-10). A use is one way the organisation uses an AI system for one purpose with one owner. One tool can have several uses.
2	Start on the Checks sheet. Set the as-at date, the date the inventory closed, the intervals and the approvers of each tier. The as-at date is the date the inventory is checked at. Type it, never a formula.
3	Find the uses. Do not rely on one source. Ask each manager what their team uses, read the single sign-on and card-spend reports, and check the release notes of the software you own for AI features (AI Use Case Intake & Approval Procedure). Free tools on personal accounts will not show in any report, so ask people and tell them nobody is blamed for answering (AG-13).
4	Enter one row for each use on the Inventory sheet. Yellow cells are inputs. Choose from the lists where a cell has one. The columns headed "working column" are not among the sixteen fields: they hold the intake answers that the tier check needs, and the tool and trigger details.
5	Copy the tools from your approved list (AI Tool Approval & Data Permission Matrix) to the Approved tools sheet. Enter the tool's ID in the Tool record cell of each use that has one. IV-10 reads the tool's state, the data level it is approved for, personal data, sign-in, training and supplier decision. A tool list carried over from an older template that has Yes or No in the training column must be changed to Contract term, Setting verified off or None.
6	Enter the tier from the intake decision (AI Use Case Intake & Approval Procedure). The workbook works out the lowest tier the intake answers give and flags a tier below it (IV-05). An answer of Stop means the use is Declined or Stopped.
7	Read the calculated columns at the right of the Inventory sheet. "Result" names the checks that fail on the row. "Review" says whether an approved use is in date. "Latest review date for the tier" is the decision date plus the months of its tier.
8	Read the Checks sheet for the findings, the counts and the sentences for the report. Report counts with the gaps named, such as "4 of 5 AI uses have a current approval", and no score or share (AG-22). The AI Use Case Risk & Impact Assessment is the place for a use that is waiting for its assessment.
9	Review each approved use at its tier's interval and whenever a trigger occurs (see the Definitions sheet). Review the whole inventory at least every 6 months (AG-10) and enter the date on the Checks sheet.
10	To clear the EXAMPLE, delete the EXAMPLE rows on the two data sheets once your own are entered. The formulas stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you govern the AI your organisation uses. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts and on how your Member State applies the Act: confirm it with counsel.

This worksheet records your own reasoning against the text of the Act. It does not say that any system is or is not prohibited, high-risk or subject to a transparency duty, and it does not say that you are a provider, a deployer or any other operator. Counsel confirms each conclusion. The column "EU AI Act reasoning" holds a pointer to the row of EU AI Act Role & Risk Classification Worksheet and the date Legal confirmed it. It does not hold a conclusion.

The checks read the cells as typed. A tier typed as text, a date typed as text or a status that is not on the list is a finding or is ignored. Dates are entered as dates.

An approval, a tier and a status are decisions of the people named in the policy. This workbook records and checks them. It does not make them.

EXAMPLE: the distributor, a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Its survey of 14 Sep 2026 to 25 Sep 2026 found 7 AI uses: 4 approved with conditions, 1 held, 1 declined and 1 stopped. The checks find 0 findings.

Adapting this template:

• Small organisation: keep the sixteen fields and the ten checks. List only uses that touch work, and group identical uses (the same tool, the same purpose, the same owner) into one row.

• Regulated organisation: add columns to the right of the calculated ones for what your regulator expects (for example the function a use supports). Do not insert columns between the fields, because the checks read them by position.

• Service provider or outsourced IT: if a supplier runs your tools, still list each AI use here under your own owner. The supplier's own AI features count when your staff use them for your work (AG-01).

• Replace the [[placeholders]] and the EXAMPLE rows with your own values. Keep the formulas.

• Change the settings on the Checks sheet to your own intervals: the months between reviews of each tier, the months between reviews of the whole inventory, and the days allowed to assess a use already running. The policy (AG-09, AG-10) states the values you chose.

• Replace the supplier references on the Lists sheet with the references in your supplier register (P06). Replace the rows of the approved tools sheet with the rows of your approved list. The check IV-10 reads that sheet.

• Rows are limited to the number the formulas cover. To add rows, copy a whole blank row (every column) to the bottom of the table.

This workbook is your own record. Keep a copy that can be reached when the main systems are down.

Checks

Settings, findings and counts

Set the yellow cells, then read the findings and the counts. Each count is a number with the others named: no score and no percentage (AG-22).

Settings

As-at date: the date the inventory is checked at	30 Sep 2026	Review dates are worked out at this date (IV-09). EXAMPLE: 30 Sep 2026. Type a date, never a formula.
Date the inventory closed (the survey ended)	25 Sep 2026	A use found already running at Tier 2 or 3 gets its assessment within the days below of this date (AG-09, IV-08).
Calendar days to assess a use already running	90	A house default. The policy states your value (AG-09).
Months between reviews of the whole inventory	6	AG-10. A house default.
Date the whole inventory was last reviewed	25 Sep 2026	EXAMPLE: the date the first survey closed.
Next review of the whole inventory is due	25 Mar 2027		In date
Working days to start a review after a trigger	10	AG-10. A house default.

Who approves each tier, and how often the approval is reviewed (IV-06)

Tier	Approver (the name used in the Approver cell)	Second approver	Review every (months)	Who decides, from the intake procedure
Tier 1: screen	AI governance lead		12	AI governance lead
Tier 2: assessment	AI governance lead	Head of Information Security	6	AI governance lead and Head of Information Security, with the use owner consulted (the owner signs the conditions it accepts and does not approve) and the Data Protection Officer's advice recorded where personal data is used
Tier 3: assessment and executive decision	Executive decision-maker		6	The executive decision-maker your procedure names (executive management by default; the board or its equivalent where your governance structure puts it), on the AI governance lead's recommendation

Keep the approver names equal to the words used in the Approver cells: IV-06 looks for each as a whole name, separated by "and" or commas, and not as part of a longer one. Where an approver owns the use, IV-06 expects the first approver of Tier 3 (the executive decision-maker) in that approver's place. Change the names if your roles have other names.

Who holds the approver roles (IV-06)

Role (follows the tier table)	Holder's title, as the Owner cell writes it
AI governance lead	Head of Risk
Head of Information Security	Head of Information Security
Executive decision-maker	Executive Committee

When the Owner cell of a use holds one of these titles (or the role's name), IV-06 treats the owner as that approver: the executive decision-maker approves in its place, and the board or its equivalent for a Tier 3 use the executive decision-maker owns. Enter your own titles.

Findings of the checks IV-01 to IV-10

Check	Rule	Result	Columns read
IV-01: Every use has a unique ID in the form AI-nnn.	AG-10	No finding	Use ID (IF-01). Duplicates are counted from the second use with the same ID.
IV-02: Every use has an owner and a role that checks the output.	AG-07	No finding	AI use owner (IF-05) and Who checks the output (IF-06).
IV-03: Every use names a tool and a supplier reference that exists in the supplier register. A use with no supplier leaves the supplier cell blank.	AG-11	No finding	Tool or feature and Supplier reference (IF-03). A supplier reference must be on the Lists sheet; leave the cell blank when there is no supplier.
IV-04: The data level is one of P15's, and special category data is never recorded as an input.	AG-03	No finding	Highest data level (IF-07) and the working column for special category data.
IV-05: The tier is not below the tier the intake answers give. A role recorded for IQ-12 clears H-4 only when IF-14 is filled (the A08 row and the date of Legal's confirmation); otherwise the check says what is missing and the tier is judged as raised, as if no role were recorded.	AG-09	No finding	Tier (IF-09) against the tier the intake answers give. The answers are in the working columns on the right. A role in the role column counts only when IF-14 is filled (the A08 row and the date of Legal's confirmation); otherwise the Result column says what is missing and the tier is judged as raised.
IV-06: An approved use has the approvers of its tier (the executive decision-maker in place of an approver who owns the use), a decision date and a review date within the tier's months, and the use owner is not among the approvers.	AG-10	No finding	Status, Approver and decision date (IF-11), AI use owner (IF-05), Tier and Next review (IF-15), for an approved use. The approvers and months of each tier are on this sheet. The use owner must not be named among the approvers: nobody approves a use they own. An owner counts as an approver when the Owner cell holds the role's name or its holder's title (Role holders table). Where an approver owns the use, the executive decision-maker (the first approver of Tier 3) is expected in that approver's place; for a Tier 3 use the executive decision-maker owns, the board or its equivalent. Each approver is a whole name in the cell, separated by "and" or commas.
IV-07: A held, declined or stopped use has its reason, and a held use has the date its hold is due to clear.	AG-10	No finding	Status (IF-10), the reason, and the date a hold is due to clear (IF-12).
IV-08: An approved Tier 2 or Tier 3 use has its assessment, or a due date within 90 days of the inventory closing.	AG-09	No finding	Assessment (IF-13), for an approved Tier 2 or Tier 3 use. The date the inventory closed and the days allowed are on this sheet.
IV-09: A review that has passed its date is listed.	AG-10	No finding	Next review (IF-15) against the as-at date. Workbook extension, not part of the check IV-09 as the pack states it: the two optional working columns for a trigger and the date its review started add one finding when a review did not start within the working days AG-10 allows.
IV-10: The tool's state on the approved list allows the use's data level and its personal data (mayProcess).	AG-03	No finding	Tool record, Highest data level and Personal data. The tool's row on the approved tools sheet, for an approved use.

A check counts the findings it makes, which can be more than one on a row. The Result column of the Inventory sheet names the checks that fail on a row.

Counts for the report (AG-22)

Count	Number
AI uses on the inventory	7
AI uses in use or proposed (Proposed, Approved, Approved with conditions or Held)	5
Status Proposed	0
Status Approved	0
Status Approved with conditions	4
Status Held	1
Status Declined	1
Status Stopped	1
Status Retired	0
Uses with a current approval: approved, with a review date that has not passed (AIM-01)	4
Tier 2 and Tier 3 uses that are approved or held	3
of which the assessment is done (AIM-02)	2
of which the assessment is not done	1
Approved uses whose review date has passed (AIM-03)	0
Uses with at least one finding	0
Findings in all (IV-01 to IV-10)	0

In words (for the report)

4 of 5 AI uses in use or proposed have a current approval (AIM-01).

2 of 3 Tier 2 and 3 uses have a completed assessment; waiting: AI-006 (AIM-02).

0 approvals are past their review date (AIM-03).

No inventory check has a finding.

AIM-04 (people who completed AI essentials) comes from the literacy record and AIM-05 (unapproved uses stopped in time) from the incident route. Neither is computed from the inventory.

Inventory

EXAMPLE: 7 AI uses as at 30 Sep 2026. One row for each AI use. Yellow columns are inputs; white columns calculate. Working columns are not among the sixteen fields.

Example	IF-01 Use ID	IF-02 Use and purpose	IF-03 Tool or feature	IF-03 Supplier reference (P06), blank for none	Tool record on the approved tools sheet (working column)	IF-04 System it sits in	IF-05 AI use owner	IF-06 Who checks the output	IF-07 Highest data level	IF-07 Personal data	Special category data recorded as an input (working column)	IF-08 Who sees the output	IF-09 Tier	IF-10 Status	IF-11 Approver	IF-11 Decision date	IF-12 Conditions and holds	IF-12 Date the hold is due to clear	IF-12 Reason for a hold, a decline or a stop	IF-13 Assessment done on	IF-13 Assessment due by	IF-14 EU AI Act reasoning (A08 row)	IF-14 Legal confirmed on	IF-15 Next review	IF-16 Notes	IQ-08 Autonomy (working column)	IQ-09 Effect on people (working column)	IQ-10 Operational effect (working column)	IQ-11 Prohibited-practice or Annex III IDs, separated by commas (working column)	IQ-12 Provider signal (working column)	Already running when found (working column)	Row in use (calc)	Approved (calc)	Tier the intake answers give (calc)	Latest review date for the tier (calc)	Approvers as whole names (calc)	First approver expected (calc)	Second approver expected (calc)	Row of its tool (calc)	Result (calc)	Review (calc)	Current approval (calc)	Tier 2 or 3, approved or held (calc)	Waiting for its assessment (calc)	Running list of uses waiting (calc)
EXAMPLE	AI-001	Drafting and summarising internal text with the office-suite assistant	Office suite assistant	SUP-005	T-01	SYS-06	Head of IT	The person who asked for the draft	Internal	No	No	Staff only: a person reviews anything that leaves the organisation	1	Approved with conditions	AI governance lead (Head of Risk)	2 Sep 2026	BC-1, BC-2, BC-3					EU AI Act Role & Risk Classification Worksheet, row AI-001		2 Sep 2027	The supplier gave notice of the feature on 5 Aug 2026 (P06 clause CL-20); P06 TP-09 review recorded 2 Sep 2026.	A person reads every output before it is used	None	Low		No	No	1	1	1	2 Sep 2027	\|ai governance lead (head of risk)\|	AI governance lead		1	No finding	In date	1
EXAMPLE	AI-002	Demand forecasting inside the warehouse management system	Warehouse system forecasting module	SUP-010	T-02	SYS-02	Head of Logistics	Inventory planner	Internal	No	No	Staff only: a person reviews anything that leaves the organisation	2	Approved with conditions	AI governance lead (Head of Risk) and Head of Information Security	28 Sep 2026	BC-1, BC-2, BC-3; dated conditions H-1			24 Sep 2026		EU AI Act Role & Risk Classification Worksheet, row AI-002		28 Mar 2027	Found in the survey as a feature in the supplier's 2025 release. The supplier's P06 assessment is planned for 20 Oct 2026. The Head of Logistics, as use owner, was consulted and signed the conditions.	A person reads every output before it is used	None	Material		No	Yes	1	1	2	28 Mar 2027	\|ai governance lead (head of risk)\|head of information security\|	AI governance lead	Head of Information Security	2	No finding	In date	1	1
EXAMPLE	AI-003	A customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions	Customer-service chatbot	SUP-013	T-05	Online ordering service (customer contact)	Chief Operating Officer	Customer service team leader, who reviews a sample of conversations each week	Confidential	Yes	No	Customers or the public deal with the system or see its output directly	3	Held		29 Sep 2026	BC-1, BC-2, BC-3, BC-4, BC-5; holds H-1, H-2, H-3	1 Dec 2026	Executive Committee, 29 Sep 2026: held until the contact centre's assessment under P06 (planned 1 Dec 2026), a bar on training on our data and processor terms for the chatbot are in place, and the Data Protection Officer has advised on a data protection impact assessment.	23 Sep 2026		EU AI Act Role & Risk Classification Worksheet, row AI-003	23 Sep 2026		Customers would talk to it directly, so the contact centre must make it tell them it is an AI system (EU AI Act Article 50(1)).	It acts, or sends output, without a person reading it first	None	Low		No	No	1	0	3		\|\|	Executive decision-maker		5	No finding			1
EXAMPLE	AI-004	Generating images for campaign material in the design tool	Design tool image generator		T-03	Design tool (Marketing)	Sales Director	Marketing lead	Public	No	No	Staff only: a person reviews anything that leaves the organisation	1	Approved with conditions	AI governance lead (Head of Risk)	23 Sep 2026						EU AI Act Role & Risk Classification Worksheet, row AI-004		23 Sep 2027	The tool is P13's APP-01, connected to single sign-on after the discovery of 15 Sep 2026. Supplier reference: [[P06 reference of the design tool supplier]]	A person reads every output before it is used	None	Low		No	No	1	1	1	23 Sep 2027	\|ai governance lead (head of risk)\|	AI governance lead		3	No finding	In date	1
EXAMPLE	AI-005	Drafting campaign wording in a free public assistant on personal accounts	Free public chat assistant		T-04	None (personal accounts)	Sales Director	None before the survey	Internal	No	No	Staff only: a person reviews anything that leaves the organisation	1	Stopped		21 Sep 2026			Not an approved tool. Found in the survey on 18 Sep 2026 and stopped on 21 Sep 2026. The four Marketing users had put draft campaign wording and launch dates (Internal) into it; they confirmed no personal data and no Confidential files. They moved to the approved assistant (AI-001) and completed AI essentials by 28 Sep 2026.			EU AI Act Role & Risk Classification Worksheet, row AI-005			Reported on 18 Sep through the incident route as an event (P09 IM-01). Triage found no personal data and no Confidential data, so it was not declared an incident.	A person reads every output before it is used	None	Low		No	Yes	1	0	1		\|\|	AI governance lead		4	No finding
EXAMPLE	AI-006	Machine-learning anomaly detection in the managed security monitoring service	Security monitoring service	SUP-006	T-06	Security monitoring service	Head of IT	Security analyst at the provider, with the Head of Information Security	Confidential	Yes	No	Staff only: a person reviews anything that leaves the organisation	2	Approved with conditions	AI governance lead (Head of Risk) and Head of Information Security	28 Sep 2026	BC-1, BC-2, BC-3, BC-4, BC-5				24 Dec 2026	EU AI Act Role & Risk Classification Worksheet, row AI-006		28 Mar 2027	Existing before the policy. The provider was assessed under P06 on 16 Jun 2026. Its assessment under A06 is due by the date shown. Its output is never used for an HR decision. The Head of IT, as use owner, was consulted and signed the conditions.	A person reads every output before it is used	None	Low		No	Yes	1	1	2	28 Mar 2027	\|ai governance lead (head of risk)\|head of information security\|	AI governance lead	Head of Information Security	6	No finding	In date	1	1	1	, AI-006
EXAMPLE	AI-007	A job-applicant ranking add-on to the recruitment system, proposed by HR	Recruitment system ranking add-on (proposed)			Recruitment system	HR Director	HR business partner	Confidential	Yes	No	Staff only: a person reviews anything that leaves the organisation	3	Declined		22 Sep 2026			Declined at screening on 22 Sep 2026 by the AI governance lead and the HR Director. It ranks candidates, which Annex III point 4(a) lists, and it profiles people, so we read it as always high-risk (EU AI Act Article 6(3)). The deployer duties start on 2 Dec 2027 and we could not meet them for a recruitment system now. We can propose it again.			EU AI Act Role & Risk Classification Worksheet, row AI-007	22 Sep 2026		HR completed AL-07 on 24 Sep 2026. Supplier reference: [[P06 reference of the recruitment system provider]]	A person reads every output before it is used	Decides or shapes a decision about a person	Low	HA-4	No	No	1	0	3		\|\|	Executive decision-maker			No finding					, AI-006

Approved tools

EXAMPLE: 6 tools as at 30 Sep 2026. Copy of the rows of the approved list (AI Tool Approval & Data Permission Matrix) that IV-10 reads. Keep it equal to the approved list.

Example	Tool ID (A07)	Tool or feature	Kind	State on the approved list	Highest data level it is approved for	Approved for personal data	Sign-in	How the supplier is barred from training on our data	Supplier decision under P06	Supplier reference (P06)
EXAMPLE	T-01	Office suite assistant (writing and summarising)	Tool staff use	Approved with conditions	Internal	No	SSO	Contract term	Approve	SUP-005
EXAMPLE	T-02	Warehouse system forecasting module	Built into a service	Approved with conditions	Internal	No	Local accounts	Contract term		SUP-010
EXAMPLE	T-03	Design tool image generator	Tool staff use	Approved with conditions	Public	No	SSO	Setting verified off
EXAMPLE	T-04	Free public chat assistant (personal accounts)	Tool staff use	Not approved	Public	No	Personal	None
EXAMPLE	T-05	Customer-service chatbot proposed by the contact centre	Built into a service	Not approved	Public	No	None	None		SUP-013
EXAMPLE	T-06	Security monitoring service (machine-learning detection)	Built into a service	Approved	Confidential	Yes	Provider-managed	Contract term	Approve	SUP-006

Lists

ListStatus	ListLevel	ListAudience	ListAutonomy	ListPeople	ListOp	ListYesNo	ListRole	ListTraining	ListTier	ListSupplier	ListSupplierName	ListToolState	ListToolKind	ListSignIn	ListDecision
Proposed	Public	Staff only: a person reviews anything that leaves the organisation	A person reads every output before it is used	None	Low	Yes	Deployer	Contract term	1	SUP-001	SUP-001 Managed IT service provider	Approved	Tool staff use	SSO	Approve
Approved	Internal	Customers or the public deal with the system or see its output directly	It acts, or sends output, without a person reading it first	Informs a decision about a person	Material	No	Provider	Setting verified off	2	SUP-002	SUP-002 Cloud hosting provider	Approved with conditions	Built into a service	Local accounts	Approve with conditions
Approved with conditions	Confidential			Decides or shapes a decision about a person			Other	None	3	SUP-003	SUP-003 Payment service provider	Not approved		Personal	Escalate
Held										SUP-004	SUP-004 ERP software provider (hosted)			None	Reject
Declined										SUP-005	SUP-005 Email and office software provider			Provider-managed
Stopped										SUP-006	SUP-006 Security monitoring provider
Retired										SUP-007	SUP-007 National parcel carrier
										SUP-008	SUP-008 Express courier
										SUP-009	SUP-009 Pallet network
										SUP-010	SUP-010 Warehouse management system provider
										SUP-011	SUP-011 Backup service provider
										SUP-012	SUP-012 Payroll bureau
										SUP-013	SUP-013 Outsourced customer contact centre
										SUP-014	SUP-014 Network connectivity provider

Definitions

Definitions

Term	Meaning in this workbook
AI system	A machine-based system that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions (EU AI Act Article 3(1)). A chat assistant, an image generator, a forecasting feature and a spam filter that learns are all AI systems. A fixed formula is not.
AI use	One way the organisation uses an AI system, for one purpose, with one owner: summarising meeting notes with the office assistant, or forecasting stock with the warehouse system. One tool can have several uses. The inventory lists uses.
Approved tool	An AI tool on the approved list (A07) with a state of Approved or Approved with conditions, and the data levels it may take.
Unapproved use	Any use of an AI tool for work that is not on the approved list, or with data above what the list allows. Sometimes called shadow AI.
Tier	How much checking a proposed use needs before it starts: Tier 1 a screen, Tier 2 an assessment, Tier 3 an assessment and an executive decision. A fourth outcome, Stop, means the use is not allowed.
Human oversight	A named person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published, and has the authority to reject it.
Training on our data	A supplier using what the organisation puts into a tool, or what the tool returns, to train or improve the supplier's models. The approved list records whether the contract or the tool's settings bar it.
Inventory	The list of every AI use, one row each, kept by the AI governance lead and reviewed by the owners (AG-10).
Working column	A column this workbook adds to the sixteen fields, for the checks.
Trigger	An event that forces a review of the use within 10 working days: a new purpose, data level or audience; a change of supplier, model or location, or a new ai feature; an incident or near miss involving the use; a complaint about the output; a change in law, guidance or the organisation's policy; a person leaving who was the owner or the checker.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
IF-nn, IV-nn, AG-nn	Fields of this inventory, its checks and rules of the policy. AI Acceptable Use & Security Policy, AI Use Case Intake & Approval Procedure and AI Use Case Risk & Impact Assessment use the same IDs.
EXAMPLE	A worked example: the distributor as at 30 Sep 2026. Every name and value is made up. Delete before use.

The sixteen fields and the columns that hold them

Field	What to enter, and the column or columns
IF-01 Use ID	AI-nnn. Rule AG-10. Column: Use ID.
IF-02 Use and purpose	One sentence from IQ-01. Rule AG-09. Column: Use and purpose.
IF-03 Tool, feature and supplier	The tool or feature, and the P06 reference or none. Rule AG-11. Columns: Tool or feature; Supplier reference.
IF-04 System it sits in	The P07 system or the application it is part of. Rule AG-10. Column: System it sits in.
IF-05 AI use owner	A named role, never a team. Rule AG-07. Column: AI use owner.
IF-06 Who checks the output	A role, with the authority to reject it. Rule AG-07. Column: Who checks the output.
IF-07 Highest data level	Public, Internal or Confidential (P15), and the Personal data marker. Rule AG-03. Columns: Highest data level; Personal data.
IF-08 Who sees the output	Staff only, or customers or the public. Rule AG-08. Column: Who sees the output.
IF-09 Tier	From the intake decision: 1, 2 or 3. Rule AG-09. Column: Tier.
IF-10 Status	Proposed, Approved, Approved with conditions, Held, Declined, Stopped or Retired. Rule AG-10. Column: Status.
IF-11 Approver and decision date	The tier's approvers. Rule AG-09. Columns: Approver; Decision date.
IF-12 Conditions and holds	BC IDs, the use's own conditions, and any hold with the date it clears. Rule AG-09. Columns: Conditions and holds; Date the hold is due to clear; Reason.
IF-13 Assessment	The A06 reference and date, or the date it is due. Rule AG-09. Columns: Assessment done; Assessment due.
IF-14 EU AI Act reasoning	The A08 row reference and Legal's confirmation date, and, where the answer to IQ-12 is Yes, the role Legal recorded (deployer, provider or other). The role clears H-4 only when the A08 row and the date are both filled. Rule AG-17. Columns: EU AI Act reasoning; Legal confirmed on; IQ-12 Role Legal recorded.
IF-15 Next review	Within the tier's months, or after a trigger. Rule AG-10. Column: Next review.
IF-16 Notes	Users, licences, decisions and history. Rule AG-10. Column: Notes.

The working columns

Column	What it is for
Tool record	The ID of the tool's row on the approved tools sheet (A07), so that IV-10 can read what the tool is approved for. Leave blank when the tool has no row.
Personal data	Yes or No. Part of IF-07 (the Personal data marker).
Special category data recorded as an input	Yes or No. IV-04 flags Yes. Special category data never goes into an AI tool (AG-03), so the use is Declined or Stopped.
Intake answers (IQ-08 to IQ-12) and Already running	The answers that decide the tier. Answer IQ-12 Yes when the use is built on a supplier's model API (prompts, retrieval, tools or code around a model the organisation calls), whether for staff or for customers; a finished product used as supplied is No. A Yes puts a new use at Tier 3 and holds it at H-4 until Legal records the role (a signal, not a classification). Enter the role Legal recorded (Deployer, Provider or Other) in the role column, with the A08 row and the date of Legal's confirmation in IF-14. The role clears H-4 only when both are filled; otherwise the Result column says what is missing and the tier stays as raised. With the evidence, a Deployer role clears the hold and the workbook works the tier out again from the other answers; a Provider or Other role also clears the hold, but the use stays Tier 3 (the executive decision-maker decides, with A08 confirmed by Legal). A use already running carries H-4 as a condition with a date. The workbook works out the tier they give and IV-05 compares it with the tier you entered. IQ-04 to IQ-07 are already in IF-07 and IF-08.
Trigger raised on, and Review started on	A workbook extension for AG-10: dates that let the workbook add a finding to IV-09 when a review did not start in time. They are optional; with both blank, IV-09 lists only a review past its date. A trigger is any of the events listed on this sheet. Enter the date it was raised, and the date the review of the use started.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.9 — Inventory of information and other associated assets	Inventory sheet: the inventory of information and other associated assets includes the AI tools and the uses made of them
ISO/IEC 42001:2023	Annex A 4.2 — Resource documentation	Inventory sheet: the organisation's list of its AI systems and the way their use is recorded and reviewed
ISO/IEC 42001:2023	Annex A 9.4 — Intended use of the AI system	Inventory sheet: the organisation's list of its AI systems and the way their use is recorded and reviewed
NIST CSF 2.0	ID.AM-02 — “Inventories of software, services, and systems managed by the organization are maintained”	Inventory sheet: the AI uses are inventoried and each has an owner
EU AI Act — Regulation (EU) 2024/1689	Article 3(1) — “AI system” means “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”	Inventory sheet: what counts as an AI use to list. A fixed formula is not an AI system, and a spam filter that learns is
EU AI Act — Regulation (EU) 2024/1689	Article 3(4) — “deployer” means “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”	Inventory sheet, EU AI Act reasoning column: most organisations are deployers of the AI they use, which Legal confirms
EU AI Act — Regulation (EU) 2024/1689	Article 3(63) and (66) — a “general-purpose AI model” is an AI model that “displays significant generality and is capable of competently performing a wide range of distinct tasks”, and a “general-purpose AI system” is an AI system based on such a model that “has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems”	Inventory sheet: a general-purpose model sits behind many assistants, so the tool and the supplier are named in IF-03
EU AI Act — Regulation (EU) 2024/1689	Article 26(6) — deployers keep the logs automatically generated by the high-risk system, to the extent the logs are under their control, “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data”	Inventory sheet, Notes column: for a high-risk system, record where the logs are kept. The duty applies from 2 December 2027 for Annex III systems
EU AI Act — Regulation (EU) 2024/1689	Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026	Checks sheet: the dates are those the facts give, as Article 113 stands after the amending Regulation
EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI)	Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689	Inventory sheet: the amending Regulation moved the dates for high-risk systems, which the EU AI Act reasoning column refers to
EU AI Act — Commission guidelines (non-binding)	Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act), 6 February 2025; non-binding	Inventory sheet: the Commission's reading of the definition of an AI system, to help decide what to list
NIST AI RMF 1.0	GOVERN 1.6 — “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.”	Inventory sheet: a mechanism to inventory AI systems, kept in step with how much risk each carries (the tier)
GDPR — Regulation (EU) 2016/679	Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”	Inventory sheet and Checks sheet: the controller must be able to show how it handles personal data, and the Personal data field, the approvals and the dates are that record
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	Inventory and Approved tools sheets: the AI tools in use are part of the assets whose security the organisation manages

Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.

The Commission’s guidelines explain how the Commission reads the Act. They are not binding, and only the Court of Justice of the European Union gives an authoritative interpretation of the Act. Member States lay down the penalties for infringements (Article 99(1)) and designate the authorities that enforce the Act, and no national text was read for these documents.

Dates are those in Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; the general date and Article 50 from 2 August 2026; Article 5(1) points (ba) and (bb) from 2 December 2026; high-risk systems under Annex III from 2 December 2027 and under Annex I from 2 August 2028.