Building an AI Systems Inventory: A Practical Guide for Irish Employers

An AI inventory register is a simple list of the AI tools your organisation uses, who owns them and what data they touch. None of the official pages we read describes a general legal duty to keep one, so we present it here as our suggestion. Even so, it is the practical starting point for nearly every other AI task, from literacy training to policy to vendor checks. If you are building the wider framework, our guide to AI governance for managers shows where an inventory fits.

Why an inventory helps (our suggestion)

You cannot govern what you cannot see. Staff in Dublin offices, like staff everywhere, may be using AI features built into email, spreadsheets, recruitment platforms and meeting tools without anyone having listed them. A register gives managers one place to answer basic questions: what is in use, who is responsible, and what would need to change if the rules or the tool changed.

It also supports tasks the official sources do describe. The European Commission's AI Literacy Q&A page (last updated 27 July 2026) recommends, as part of a minimum approach, determining whether your organisation is a provider or a deployer and assessing the risks of the AI systems involved. That is much easier from a list.

What the official sources say that is relevant

The consolidated text of Regulation (EU) 2024/1689 on EUR-Lex (version dated 27 July 2026) defines an AI system as "a machine-based system that is designed to operate with varying levels of autonomy". It defines a provider as a natural or legal person, public authority, agency or other body that develops an AI system, and a deployer as one "using an AI system under its authority", excluding use in the course of a personal non-professional activity.

The Commission's "Navigating the AI Act" page (last update 7 August 2026) gives an example of the difference: a developer of a CV-screening tool is a provider, and a bank using that tool is a deployer. For high-risk systems, that page says deployers must use the system in accordance with the instructions of use, assign human oversight to a person in their organisation, and monitor the system. Where the system is used in the workplace, deployers must beforehand inform affected employees and workers' representatives.

The text of Article 26(7), as we read it on EUR-Lex, says that before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the system. An inventory makes it easier to spot where that could apply.

Which dates matter

The Commission's AI Act page (last update 3 August 2026) says employment is among the high-risk areas, including AI tools for employment, management of workers and access to self-employment, and that those rules will apply from 2 December 2027, following the Digital Omnibus, which it says entered into force on 27 July 2026. The same page says prohibited practices 1 to 8 became effective in February 2025. Dates have changed during this process, so check the current position before relying on any date, including the ones here.

What to record for each tool (our suggestion)

Keep the register short enough that someone will actually maintain it. A practical approach is one row per tool, with these columns:

• Name and vendor: including the product name as staff know it.
• Business owner: a named person, not a department.
• Purpose: what it is used for in plain words.
• Users: which teams or roles use it, including contractors acting on your behalf.
• Your role: provider or deployer, using the Act's definitions above.
• Personal data involved: whether any personal data goes in or comes out, and whose.
• Affects people? for instance recruitment, performance or monitoring uses, which may need extra care.
• Human oversight: who checks outputs before they are relied on.
• Approval status and date: approved, trial, or not approved.
• Review date: when you will look at it again.

Borrow the habit from records of processing

Data protection already has a familiar model. The Data Protection Commission's guidance on Article 30 GDPR says controllers must maintain a Record of Processing Activities and that controllers and processors must be able to provide such records to the DPC on request. The DPC page presents the record as a way to demonstrate accountability. The page shows no publication date. An AI register is not the same thing and is not a substitute for that record, but if you already keep one, the two can reference each other. Where an AI tool processes personal data, check whether your existing record needs updating.

Organisations that want a more formal structure around AI may also look at management-system standards. Our explainer on the ISO/IEC 42001 AI management system covers that route, and in our view a register like this is useful groundwork if you go that way.

The DPC's July 2024 blog on AI and large language models also lists points that fit naturally into a register: what personal data a system uses, how it uses it, where the data goes when a third party is involved, and whether the provider retains or reuses it. In the section addressed to AI product designers, developers and providers, it says a data protection impact assessment may be required and describes doing one anyway as best practice. It does not address organisations that only deploy third-party tools on that point.

How to find the tools

1. Ask each team lead to list the AI features they use, including ones inside tools they already pay for.
2. Check software purchasing and subscription records for AI products.
3. Ask IT which AI assistants or plug-ins are enabled in your productivity suite.
4. Invite staff to declare personal-account tools they have used for work, without blame, so you can decide what to allow.

All four steps are our suggestions. Expect the first list to be incomplete, and treat it as a living document.

Connect the register to your policy

Once tools are listed, a policy can say which are approved and for what. Our guide to what to cover in a generative AI acceptable use policy explains the policy side. The register and the policy should agree: if a tool is not on the list, staff should know how to request it.

Keeping it current

• Assign one owner for the register as a whole.
• Review it on a fixed rhythm and whenever a tool is bought, switched on or retired.
• Note which legal pages you relied on and their dates, since this area is changing.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is an AI inventory a legal requirement?

The official pages we read do not describe a general duty to keep an inventory of all AI tools. We suggest one as good practice. Specific duties may arise for particular systems, so check the current text of the Act.

Who should own the register?

Our suggestion is a named manager with authority across teams, supported by IT and whoever handles data protection. The Commission's Q&A page says no AI officer or governance board is required.

Should free tools be included?

Yes, if staff use them for work. The deployer definition covers using an AI system under your authority, and personal data entered into free tools is a data protection concern.

How often should it be reviewed?

There is no official frequency. A practical approach is a regular scheduled review plus updates whenever a tool changes.

A modest register that is kept up to date is worth far more than an elaborate one that is not.