Skip to main content
Praxikon
Agent check

Free template · Excel · English and Dutch

AI register template: AI system inventory and classification workbook (Excel)

An AI register is an internal list of every AI system your organisation develops or uses. For each system it records your role (provider or deployer), the risk class under the AI Act and the obligations still open. The AI Act prescribes no format; the register is the basis for showing your classification and measures.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:ai-register
Legal basis
Articles 3, 4, 5, 6, 25 to 27, 49 and 50 and Annex III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; Articles 22 and 35 GDPR

Who is this template for?

  • Owner of AI governance or compliance officerKeeps the register, determines the role and risk class per system (Articles 3, 5 and 6 AI Act) and records the AI literacy measures (Article 4)
  • Owner of an AI system (head of department or product owner)Answers the intake questions and, as deployer, ensures use in line with the instructions for use and human oversight (Article 26(1) and (2), from 2 December 2027 for Annex III high-risk systems)
  • Product team that builds AI or offers it under its own nameIs the provider: documents any reliance on the Article 6(3) derogation in advance (Article 6(4)) and registers the system (Article 49(2))
  • Data protection officer or privacy officerAssesses the DPIA and automated decision-making per system for the organisation as controller (Articles 22 and 35 GDPR)
  • Procurement and contract managementRecords the AI terms agreed with the supplier, such as the data processing agreement (Article 28 GDPR) and, for high-risk systems, the instructions for use (Article 13)
  • Public sector bodyAs deployer, carries out a fundamental rights impact assessment before first use of an Annex III high-risk system (other than point 2) and registers the use (Articles 27, 26(8) and 49(3), from 2 December 2027)

What is inside

  • About this template: six steps to complete the workbook, plus fields for organisation, owner and review date
  • Dashboard: 21 self-calculating counts in three groups: an overview by status, red signals to resolve first (such as a possible prohibited practice or an Article 50 obligation without a measure) and planning (high-risk, FRIA, contracts, reassessment)
  • Intake: 31 questions per AI system for its owner, from the definition of an AI system (Article 3, point 1) to prohibited practices (Article 5), Annex I and III, Article 50, the GDPR and contracts, each with a signal and a next step
  • Register: one row per system with a fixed ID, your role (Article 3), a possible shift of role (Article 25(1)), DPIA, FRIA, Article 4 measures and the next review date; room for 50 systems
  • Classification: step by step from AI system to prohibited practice, Annex I (Section A or B), Annex III, the Article 6(3) derogation and profiling; the workbook calculates the outcome and a status
  • Duties by role: 32 obligations with article, role (provider, deployer or controller under the GDPR) and the date since or from which they apply
  • Annex III: the verbatim consolidated text of all 25 points, with whether a FRIA is required (Article 27) and how registration works (Article 49) for each
  • Six fictional worked examples, including a chatbot, a recruitment tool and a system that falls under a prohibition

How to use the template

  1. Ask the owner of each AI system to complete the Intake sheet, using one copy of the sheet per system. Include AI features a supplier has added to existing software.
  2. Enter each system with a fixed ID in the Register and record your role: provider, deployer or both.
  3. Classify each system on the Classification sheet, from left to right. Record what each choice is based on.
  4. Resolve the red signals on the Dashboard first, such as a possible prohibited practice or an Article 50 obligation without a measure. Then plan the work for 2 December 2027.
  5. Replace the six fictional examples and review the register for every new or changed use case, and at least every six months.

Common mistakes

  • Listing only tools bought as 'AI'. AI features in HR, CRM or office software are often AI systems too and belong in the register.
  • Confusing the internal register with registration in the EU database (Article 49). That applies only to certain providers and to public authorities as deployers.
  • Relying on the Article 6(3) derogation while the system profiles natural persons. With profiling, an Annex III system is always high-risk.
  • Assuming you are always the deployer. If you put your name on a system, modify it substantially or change its intended purpose, you can become the provider (Article 25(1)).
  • Treating Article 50 as a future obligation. The transparency obligations have applied since 2 August 2026; only the machine-readable marking of Article 50(2) has a transition to 2 December 2026 for systems already on the market before that date.

Prefer to work online? Annex III classification check · Inventory AI systems online

When do you need legal advice?

  • The classification depends on a derogation. You want to rely on Article 6(3) for an Annex III use case. That is not possible where natural persons are profiled, and the provider must document the assessment in advance (Article 6(4)).
  • Your role may shift. You put your name on a high-risk AI system, make a substantial modification to it (Article 3, point 23), or use a system for an Annex III purpose the supplier did not intend. Under Article 25 you then become the provider, with the obligations of Article 16.
  • The use case touches a prohibition or the GDPR. A use case comes close to Article 5, such as emotion recognition of staff, or takes or supports decisions about people based on personal data. If the decision rests (almost) solely on the output, Article 22 GDPR also applies (in the Netherlands supplemented by Article 40 of the Dutch GDPR Implementation Act, the UAVG), and a DPIA is often required (Article 35 GDPR); you carry those obligations as controller.

Frequently asked questions

Is an AI register mandatory under the AI Act?

The AI Act does not prescribe an internal register or a fixed format. You do need to know your role and the risk class of each system to know which obligations apply, and the AI literacy measures have applied since 2 February 2025 (Article 4). An internal register is the practical way to keep track of this and to demonstrate it.

Is this the same as registration in the EU database?

No. Registration in the EU database (Article 49) applies to providers of Annex III high-risk systems, to providers relying on the Article 6(3) derogation and to public authorities as deployers. The provision has applied since 2 August 2026, but only takes effect once a system counts as high-risk (Annex III: 2 December 2027). Some Member States also run national public registers for government algorithms, such as the Dutch Algoritmeregister; publishing there is a separate national step.

From when do the high-risk obligations apply?

For Annex III systems from 2 December 2027, and for products under Annex I, Section A, from 2 August 2028. For products under Annex I, Section B, such as machinery or vehicles, the requirements apply through that sectoral legislation (Article 2(2)). A system placed on the market or put into service before that date is only covered after a significant change in its design (Article 111(2)). Law as of 6 October 2026.

When does the Article 6(3) derogation apply?

An Annex III system is not high-risk if it only performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns or deviations from them without replacing or influencing the previously completed human assessment without proper human review, or performs a preparatory task. If the system profiles natural persons, the derogation never applies. The provider documents the assessment in advance (Article 6(4)) and registers the system (Article 49(2)).

Which obligations apply already?

The prohibited practices and the AI literacy measures have applied since 2 February 2025 (Articles 5 and 4), the transparency obligations since 2 August 2026 (Article 50). Two new prohibitions, on non-consensual intimate imagery and on child sexual abuse material, apply from 2 December 2026 (Article 5(1)(ba) and (bb)). The GDPR has applied since 25 May 2018, including to AI.

Does the workbook give a legal opinion?

No. The workbook shows where you need to look further. For a borderline case, such as reliance on the Article 6(3) derogation or a possible shift of role, a reasoned classification opinion is the next step.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, AI register template: AI system inventory and classification workbook (Excel), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/ai-register-template

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597