Using AI tools at work? Start with an inventory.

Why start with a list

The EU AI Act has been in force since August 2024 and applies in stages. The rules on banned practices and on AI literacy (making sure staff who use AI understand it well enough) have applied since February 2025. Most other duties phase in from August 2026 onwards.

Every one of those duties depends on the same first question: which AI systems do you use, and what for? You can’t judge risk, train people or answer a customer’s questionnaire without that list.

What to record for each tool

• The tool and supplier, including AI features switched on inside software you already pay for.
• Who uses it and roughly how often.
• What it is used for, in one plain sentence.
• What data goes in: none, internal documents, customer data, or special category data such as health.
• Whether its output affects people: hiring, credit, access to services, grading.
• An owner who answers questions about it.

Sorting by risk

Once the list exists, most entries are low risk: drafting text, summarising your own documents. A few deserve a closer look. Anything used to screen job applicants, assess people or make decisions about them can fall into the Act’s high-risk categories, and anything that sends personal data to a supplier also needs a GDPR check: a lawful basis, a processing agreement and, where the risk is high, a DPIA.

Turn the list into a short policy

A one-page AI use policy usually covers: which tools are approved, what data must never go in, when a person must check the output, and who to ask. Pair it with ten minutes of training for the people who use the tools. That covers the literacy duty in a way you can show.

Keep it current

Review the inventory every six months and whenever someone asks for a new tool. Note the date of each review. An inventory that is a year old is the first thing an auditor or customer will notice.