Template · Written by Yobel Tzegai · Last checked 9 October 2026
One row per AI system: what it is for, whether you are its provider or deployer, its risk class and the provision it rests on, its owners and the person who confirmed the classification on a stated date. The Regulation never uses the word inventory, so this free template from complipath.io says for each column which provision it helps you answer.
| Column | What goes in it | Provision |
|---|---|---|
| AI system | The name your teams use for it, one row per system and intended purpose. | Practice, not law |
| Intended purpose | What it is used for and in which context. Article 3, point (12) defines it by the information the provider supplies in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation. | Article 3, point (12) |
| Your role | Provider if you develop it or have it developed and place it on the market or put it into service under your own name or trademark, whether for payment or free of charge. Deployer if you use it under your authority, other than in a personal non-professional activity. | Article 3, points (3) and (4) |
| Vendor | The company you bought it from, or the provider of the model you build on. | Practice, not law |
| Business owner | The person accountable for how it is used. | Practice, not law |
| Technical owner | The person who runs it technically. | Practice, not law |
| Decides about people | Whether you use it to make decisions, or to assist in making them, related to natural persons. For a high-risk Annex III system you deploy, Article 26(11) then has you inform those persons; for law enforcement purposes, Article 13 of Directive (EU) 2016/680 applies. | Article 26(11) |
| Risk class | Prohibited (Article 5), high-risk (Article 6), transparency obligations (Article 50) or none of these. Article 50 obligations can apply alongside the high-risk ones: Article 50(6) says its paragraphs 1 to 4 do not affect the requirements and obligations of Chapter III. | Article 5, Article 6 and Article 50 |
| Provision it rests on | The exact provision behind the class, such as point 4(a) of Annex III with Article 6(2), or Article 6(1) with the Annex I legislation the product falls under. | Article 6(1) and (2), Annex I and Annex III |
| Article 6(3) assessment | Where you, as provider, consider an Annex III system not high-risk: the documented assessment Article 6(4) requires before it is placed on the market or put into service, and its registration under Article 49(2). An Annex III system that performs profiling of natural persons is always high-risk (Article 6(3), third subparagraph). | Article 6(3) and (4) |
| Applies from | The date the system's duties apply from, with the provision that sets it: for the high-risk duties of an Annex III system, 2 December 2027 (Article 113, third paragraph, point (c)(i), as replaced by Regulation (EU) 2026/1744). | Article 113 |
| Confirmed by | The person who confirmed the classification. | Practice, not law |
| Confirmed on | The date they confirmed it. | Practice, not law |
| Law version | The text the classification answered, such as Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, so you can tell which rows an amendment touches. | Practice, not law |
| People who work with it | Who operates or uses it on your behalf, so that your AI literacy measures reach them. | Article 4(1), as replaced by Regulation (EU) 2026/1744 |
| Next review | When the row is checked again. A change of purpose, vendor or law is a reason to check it sooner. | Practice, not law |
| AI system | Intended purpose | Your role | Vendor | Business owner | Technical owner | Decides about people | Risk class | Provision it rests on | Article 6(3) assessment | Applies from | Confirmed by | Confirmed on | Law version | People who work with it | Next review |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Support assistant (example) | Answers Harbrook's customers in the help chat | Provider | [Model provider] | [Name], customer service | [Name], engineering | No | Transparency obligations | Article 50(1) | Not applicable: not an Annex III system | 2 August 2026 (Article 113, second paragraph); the later date in Article 111(4) covers only Article 50(2) | [Name] | [Date] | Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 | The customer service team | [Date] |
| CV screening (example) | Filters job applications for Harbrook's recruiters | Deployer | [Vendor] | [Name], people team | [Name], IT | Yes | High-risk | Point 4(a) of Annex III, with Article 6(2) | Not applicable: Harbrook is the deployer | 2 December 2027 (Article 113, third paragraph, point (c)(i), as replaced) | [Name] | [Date] | Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 | The recruiters who use it | [Date] |
Complipath's AI inventory keeps every AI system you build or use with its owners, its risk level, the provision it rests on and who confirmed it, and exports the whole register as a spreadsheet, as JSON or as a PDF with the law texts it was assessed against. register.
Article 3, points (3), (4) and (12); Article 4(1), as replaced by Regulation (EU) 2026/1744; Article 5; Article 6(1) to (4); Article 16; Article 26; Article 49(2); Article 50; Article 113, second paragraph; Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744; Annex I; point 4(a) of Annex III. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
€499 a month
Prices exclude VAT.
Not by that name: the word does not appear in the Regulation. Its duties attach to each system, though, from the AI literacy measures of Article 4 for every provider and deployer to the high-risk duties of Article 16 and Article 26, and none of them can be met for a system nobody has listed.
Yes. Article 4 applies to providers and deployers of AI systems whatever the risk class, and Article 50 can apply to systems that are not high-risk. A row that records none of these, with the provision it was checked against and the person who confirmed it, is an answer you can show. A missing row is not.
Because the law changes. Regulation (EU) 2026/1744 replaced Article 113, third paragraph, point (c): Chapter III, Sections 1, 2 and 3, except Article 6(5), now apply from 2 December 2027 for systems high-risk under Article 6(2) and Annex III and from 2 August 2028 under Article 6(1) and Annex I.
Complipath's AI inventory keeps each system with its owners, its risk level, the provision it rests on and who confirmed it, and exports the register as a spreadsheet, as JSON or as a PDF with the law texts it was assessed against. A rule engine decides the risk level and names the article, and a person confirms it.