Record the use case as well as the tool.
The same assistant can support internal drafting, customer advice or recruitment decisions. Those uses may involve different information, people and consequences. Keep the supplier and underlying model linked to the system, but give each materially different business use enough context for a meaningful review.
An inventory can include purchased software, embedded AI features, internally developed systems and tools first declared by employees. Mark uncertain information clearly rather than turning assumptions into facts.
Give every record a responsible owner.
Capture a business owner who can explain the purpose and a technical or supplier contact who can answer operational questions. Record the department, intended users, affected groups, data categories and where outputs are used. Include the evidence source and the last confirmation date so later reviewers understand how reliable the entry is.
- System and use-case identifiers.
- Supplier, model or service dependencies where known.
- Intended purpose and boundaries of use.
- Owner, reviewer and next review date.
Use statuses that reflect real decisions.
Proposed, under review, approved with conditions, restricted and retired mean different things. Define the evidence and authority required to move between them. A record should not become approved simply because every form field has been completed.
Retirement also needs a decision trail: when use ended, what data or integrations remain, who confirmed the change and which retention obligations still apply. Historical records should remain distinguishable from current operational approval.
Turn the inventory into a useful review queue.
EUAIC work can be scoped to establish the record structure, import reviewed source information and define the ownership and review process. Practical outputs include a reconciled starting register, a list of unowned entries and a prioritised set of missing-information requests.
Measure completeness against agreed sources and scope. An inventory built from employee declarations alone should not be described as a complete automated discovery of every AI tool. Coverage gaps are valuable findings when they are visible and assigned.