When an AI-related obligation arrives, the usual first move is to open a new spreadsheet. The logic is understandable: new instrument, new document. The consequence is predictable.
A year later there are two lists. One knows about every server but not which of them runs a model. The other knows about the models but not who owns the system they run on. Neither is complete and nobody knows which is more recent.
What both registers ask for identically
| Data point | Asset register | AI inventory |
|---|---|---|
| System name and description | yes | yes |
| Owner | yes | yes |
| Business process supported | yes | yes |
| Criticality | yes | yes |
| Types of data processed | yes | yes |
| Supplier and contract | yes | yes |
| Processing location | yes | yes |
| Risk assessment | yes | yes |
Eight entries you are maintaining anyway. Measure 2 of Annex II of the Croatian Cybersecurity Regulation requires an asset inventory with classification and identification of critical assets - that is the same job.
The four columns you add
- Is the system AI-based - yes, no, or contains an embedded component. The third value matters, because it captures existing software that acquired AI functionality through an update.
- Use case - specifically, not "assistant". The same tool used three ways produces three rows.
- Your role - are you using the system, developing it, or have you modified it and put your name on it. This determines the scope of your obligations.
- Risk level and reasoning - the conclusion of the assessment, with a sentence saying why. The sentence matters more than the label.
Obligations under the AI Act depend on application, not technology. A register with one row per tool cannot carry a classification, because the same tool can be minimal and high risk at the same time. One row per use case solves this without a single additional table.
What you gain beyond tidiness
- Risk assessment happens once. The risk of losing system availability and the risk of a wrong decision the system produces are assessed in the same register, with the same methodology and the same owner.
- The supply chain is covered. An AI service provider is a third party like any other, entering the assessment under measure 8 with no separate procedure.
- Data protection attaches at the same place. Where personal data goes in, the link to the record of processing activities runs through the same row.
- Monitoring has one source. Log collection and behaviour monitoring rely on the inventory - a system that is not in the inventory is not under monitoring either.
The first step, concretely
Open your existing asset register, add four columns and walk the list. For most rows the answer to the first question is "no" and the work is done in a minute. The rows answering "yes" or "contains a component" will be fewer than expected, and they are precisely the ones needing attention.
What you will be missing is not systems from IT but tools introduced by staff and AI features that arrived through an update of existing software. Those are not found in a spreadsheet but in a conversation with process owners.
The same principle applies to the DORA register of information and to the GDPR record of processing activities. Each asks for a view of the same assets from a different angle. Organisations that maintain them as views on one source report; those that maintain them separately transcribe.
Sources
Not sure where you stand?
Half an hour of conversation, with no obligation. By the end you know what needs doing and in what order.