The 45-minute AI inventory

In most companies, AI does not arrive as one project. Someone drafts an email with an assistant. A sales tool adds a summary. A colleague pastes a customer document into a chatbot. A vendor turns on an AI feature in software the company already pays for.

The owner may know that "we use ChatGPT". That sentence does not describe the recurring work. Which work is it? What information enters? Who checks the result? What happens when it is wrong?

Start there. Not with a forty-page policy.

The table to fill

Copy these seven headings into a note or a spreadsheet. Fill five uses already in the work. You do not need an account, a file, or an email. If something is unclear, write "unknown".

Forty-five minutes is a limit for those first five rows. It is not a claim that every company is finished.

Download this inventory table (.csv)

"Marketing uses AI" is vague. "The assistant turns a product note into a first-draft newsletter, sees internal pricing, and the marketing lead checks it before publication" is something a company can discuss.

What each column is for

AI use names the work, not the brand. Summarising service reports. Drafting quotations. Sorting incoming requests.

Tool is the application, vendor, or feature inside software you already pay for. The model name alone is not enough.

Workflow is where it sits in the recurring work: first draft, recommendation, classification, customer reply, or internal search. The vendor's label is not your use.

Info seen is the uncomfortable column. Personal data, customer material, prices, source code, or nothing sensitive. If nobody knows what the vendor keeps, write "unknown".

Output is what comes back: a draft, a score, a summary, a recommendation, or a message that could leave the company.

Human checker is a named person at a named point. "Someone" is not an owner.

If wrong? is the consequence. A bad internal summary may cost ten minutes. A bad quotation, hiring recommendation, or customer answer may cost more. A review is not real if nobody knows what to check.

Where this stops

Filling this table does not meet Article 4. It does not classify a system, remove a risk, or replace a qualified specialist.

Article 4 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 and shown in the consolidated text of 27 July 2026, requires providers and deployers to take measures to support AI literacy. It does not require them to guarantee any specific level for any individual, or one certificate for every person.

The Commission Q&A, updated 27 July 2026, still opens with "sufficient level". That line is not the amended rule. Use the consolidated regulation for the wording.

The AI Act is not one rule for every use. A company using a vendor tool is not automatically in the same role as a company that builds and places a system on the market.

Do not copy a generic policy and call the problem solved. Do not classify a system from its tool name. Do not paste sensitive material into a new tool before you know the data path.

Five honest rows are more useful than a policy nobody can connect to the recurring work.

This is practical orientation, not legal advice. For a consequential or high-risk use, involve qualified legal and technical specialists and check the current official text. This table is not a compliance programme, a certificate, or proof that any obligation has been met.

• Consolidated Regulation (EU) 2024/1689, 27 July 2026
• Regulation (EU) 2026/1744
• Commission AI literacy Q&A, 27 July 2026

Earlier pieces in this series:

• EU AI Act: list where your company already uses AI
• The EU AI Act Is Not One Rule for Every AI Use
• Using an AI Tool Still Means Responsibility | AI Act