← All templates

    High-Risk AI Inventory (EU AI Act prep)

    A first list of every AI system that affects decisions about people, so you know what may fall under the EU AI Act’s high-risk rules before the deadline.

    For legal, compliance, HR and the CIO, together. Relevant to any company that offers AI systems in the EU or whose AI output is used there, wherever it is based. · Updated November 2026

    Why this matters now

    • The Digital Omnibus amendments, finalized in July 2026, moved the main high-risk obligations to 2 December 2027, and product-related ones to 2 August 2028. Deferred, not cancelled. [Orrick, July 2026]

    How to fill it in

    1. Start with decisions about people: hiring, promotion, credit, insurance, education, access to services.
    2. Include vendor tools, not only what you built. Ask each vendor what role they take under the Act.
    3. Mark "unsure" honestly. An unsure row is a question for your lawyer, not a reason to skip it.
    4. Give every row a next step and a date.

    The template

    The first row is an example. Replace it with your own.

    System
    Name
    Vendor or in-house
    Who built it
    Decision it affects
    About which people
    Area (see list below)
    Or "none"
    EU link
    Offered or output used in the EU? yes / no / unsure
    Our role
    Provider / deployer / unsure
    Owner
    Named person
    Data used
    Personal data?
    Human oversight
    Who can override or stop it
    Documentation
    None / partial / complete
    Next step and date
    Concrete
    CV screening toolVendorWhich applicants reach interviewEmploymentYes (hiring in EU office)DeployerHR Director (name)CVs: personal dataRecruiter reviews every rejectionPartialAsk vendor for technical documentation, by 2027-01-31

    High-risk areas listed in Annex III of the EU AI Act

    • Biometrics (where permitted)
    • Critical infrastructure
    • Education and vocational training
    • Employment, workers management and access to self-employment
    • Access to essential private and public services (e.g. credit scoring, life and health insurance pricing)
    • Law enforcement
    • Migration, asylum and border control
    • Administration of justice and democratic processes

    Summary only. Each area has specific conditions and exceptions in the text of Regulation (EU) 2024/1689. EUR-Lex

    General information to help you prepare, not legal advice. Confirm classification and obligations with your legal counsel.

    Free to use and adapt inside your organization. Suggestions or corrections: hello@lumisai.space