You need an AI inventory. A template alone will not keep it true.

Most searches for an AI inventory template are looking for a column layout. The columns are the easy part — you can write them in an afternoon. The hard part is that an inventory is only worth anything if it is still true in six months, and a template has no opinion about that.

Das Wichtigste in Kürze

The EU AI Act does not require private companies to register the AI systems they use. Registration in the EU database under Article 49 applies to providers of high-risk systems and to public-sector deployers.
Several other duties do effectively require an inventory: DORA Article 28(3) for financial entities, GDPR Article 30 where personal data is involved, and NIS2 supplier and asset management.
Deployers of high-risk AI systems must keep automatically generated logs for at least six months under Article 26(6) of the AI Act.
A workable inventory needs six groups of fields. A spreadsheet carries four of them; evidence and change history are the two it cannot hold.
The failure mode is not a missing column. It is that nobody can say which version of the inventory was in force on a given date — and that is exactly what an auditor or a customer asks for.

Does any rule actually require an AI inventory?

This matters more than it sounds, because a lot of published advice asserts a registration duty that does not exist for most companies. The honest answer has three parts.

No general AI register duty for private deployers

Article 49 of the AI Act governs registration in the EU database. It applies to providers of high-risk systems listed in Annex III, and to deployers that are public authorities or EU bodies. A private company using a high-risk system is not named there. If someone tells you that your company must register its AI systems with Brussels, ask which provision they mean.

But several duties cannot be met without one

Duty	Who it applies to	What it needs from you
DORA Art. 28(3)	Financial entities in the EU	A register of all contractual arrangements for ICT services, submitted at least annually. External AI services are ICT services.
GDPR Art. 30	Most organisations	Records of processing activities — which covers any AI system that touches personal data.
NIS2	Essential and important entities	Supply chain and asset management, including the ICT services you depend on.
AI Act Art. 26(6)	Deployers of high-risk systems	Retention of automatically generated logs for at least six months.
AI Act Art. 4	Everyone using AI	Sufficient AI literacy of staff — which you cannot target without knowing which systems are in use.

Quelle: Regulation (EU) 2024/1689 (AI Act), Articles 4, 26 and 49. Regulation (EU) 2022/2554 (DORA), Article 28(3). Regulation (EU) 2016/679 (GDPR), Article 30. Directive (EU) 2022/2555 (NIS2). High-risk obligations under Annex III were postponed to 2 December 2027 and under Annex I to 2 August 2028. · Stand October 2026

Five regulatory duties — DORA Article 28(3), GDPR Article 30, NIS2, AI Act Article 26(6) and AI Act Article 4 — converging into a single AI inventory that answers all of them. — No rule names an AI inventory for private deployers. Five separate duties still ask the same underlying question. — scrolls sideways on narrow screens.

So the inventory is an instrument, not an obligation

That is a better starting point than a compliance checkbox. You are not building it because a regulation names it. You are building it because four separate duties all ask the same underlying question — what do you use, who owns it, and what can you show? — and answering it once is cheaper than answering it four times.

The fields

Six groups. The right-hand column is the part most templates leave out: whether a spreadsheet can actually carry that group.

Six field groups of an AI inventory — identity, use, risk, ownership, evidence and history — each marked with whether a spreadsheet can carry that group. — The first four groups are a matter of effort. The last two are the ones a spreadsheet cannot hold. — scrolls sideways on narrow screens.

Why the template is the easy part

Here is the pattern, and it is remarkably consistent. The inventory is created in a focused week. It is accurate on the day it is finished. Then:

A team activates an AI feature in software you already licensed. No purchase, no ticket, no entry.
A vendor adds a model to an existing product. Your contract does not change, so nothing triggers a review.
Someone leaves, and the owner field still carries their name.
A risk classification is corrected by overwriting the cell. The previous value is gone.

None of these is negligence. Each one is a change that no mechanism was watching. After two or three months, two departments hold different versions, and the question “which one is current” has become a matter of negotiation rather than fact.

A spreadsheet shows a state. It does not show how that state came about — and the duties above are mostly about the latter.

Timeline in three stages showing how an accurate AI inventory becomes wrong: complete on day one, first undetected drift by day thirty, and several competing versions by day ninety. — Nothing here is negligence. Each change simply had no mechanism watching it. — scrolls sideways on narrow screens.

When a spreadsheet is the right answer

It often is, and saying otherwise would be selling. Use one if all of these hold:

You are taking stock for the first time and have no overview at all.
One named person maintains it, not three departments.
Nobody outside the company has to rely on the result.
You do not yet need to show what was true at an earlier date.

The line is crossed when a third party has to be able to check the result: a customer in a supplier questionnaire, an auditor, or a supervisory authority. At that point the missing property is not a column. It is the inability to demonstrate that the record was not altered after the fact.

What Regovio does

To be explicit about scope: Regovio does not produce regulatory filings. It is not a DORA submission tool and it does not generate the supervisory templates. It covers the inventory, the assessment and the evidence underneath them.

Requirement	Regovio	Status
Inventory of AI assets and workflows	Register with type, lifecycle and relationships	heute verfügbar
Ownership per asset	Explicit role assignment, not a text field	heute verfügbar
Structured assessment	Personal data, automated decisions, criticality, human oversight	heute verfügbar
Evidence as first-class objects	Type, source, validity and versions, linked to the asset	heute verfügbar
Change history	Append-only audit log with actor, timestamp and before/after	heute verfügbar
Hand something out	Audit export with a SHA-256 manifest per file	heute verfügbar
Formatted PDF dossier	Export produces a reproducible package, not a designed document	auf der Roadmap — heute nicht enthalten
Regulatory filings, submission files	Not included and not planned	auf der Roadmap — heute nicht enthalten

A note on language

Regovio is built for the European mid-market, and most of this site is in German — including the contact form. This page is the first of the English track. If you read German, the fuller treatment of the same question is at KI-Register in Excel: wo die Liste aufhört, and the DORA angle at DORA-Informationsregister.