Dokuflex includes a free AI tools inventory: record every artificial intelligence tool and system your company develops or uses, from ChatGPT or Copilot to the scoring in your CRM, classify it by risk level under the EU AI Act and keep the evidence next to the record. Guided form, 11 automatic rules, dashboard and six samples. It is activated in under a minute, with no implementation project, from the module catalogue of Dokuflex, the low-code BPM platform with AI, with data hosted in the EU.
An AI tools inventory (or AI systems register, in the language of the Regulation) is the inventory of the artificial intelligence tools and systems an organisation develops or uses, with the intended purpose, the provider, the data, the role (provider or deployer) and the risk level of each one under the EU AI Act. It is the evidence that the national AI authority (AESIA in Spain), an auditor or a customer will ask you for.
Regulation (EU) 2024/1689 regulates each system according to its purpose and its risk level, and divides the obligations between whoever develops it (provider) and whoever uses it under its own authority (deployer). For an SME or mid-sized company there are four duties:
The fines under Article 99 reach 35 million euros or 7 % of worldwide turnover for prohibited practices, 15 million or 3 % for the rest and 7.5 million or 1 % for supplying inaccurate information to the authorities (in Spain, AESIA). None of the four duties can be met without first knowing which systems there are and what type they are: the field-by-field guide is in how to inventory and classify the AI your company already uses (in Spanish).
The Regulation also applies to SMEs, and an AI register for companies is not a luxury of large corporations; in its fines (Article 99) the lower of the two amounts applies, the fixed figure or the percentage. What changes is the calendar: each date adds obligations to specific systems, and the AI systems register is what lets you demonstrate at each one what you have, what risk it carries and what measures you have adopted.
Since 2 February 2025 the Article 5 practices are prohibited and staff who use AI must be trained (Article 4). From 2 August 2026 you must inform that people are interacting with an AI or that content is generated (Article 50), which affects any chatbot and text or image generator. In the register: all systems registered, the “prohibited” status applied to the unacceptable ones and transparency confirmed in each limited-risk record.
CV screening, employee evaluation, credit scoring, insurance, education or biometrics come to require human oversight, data control, event logging, DPIA and information to workers (Article 26). In the register: Annex III category, conformity assessment date, CE marking, oversight measures and the provider's documentation attached to each record before that date.
A complete AI governance platform makes sense when the organisation develops and operates its own models. For those who mostly use purchased AI, the starting point is simpler: inventory, risk classification, evidence and traceability. Dokuflex covers it with a free module within its low-code BPM software with AI, with data hosted in the EU (in Spanish), and it grows with the low-code designer if your internal policy requires an approval flow or fields specific to your sector.
Almost all companies start the inventory in a shared spreadsheet and almost all abandon it in the first quarter, because the register has to do things a spreadsheet does not do:
And the spreadsheet only captures what IT bought. The AI embedded in the ERP or the CRM and the AI employees use on their own (shadow AI) does not appear until registration is a form any department can fill in. For that first pass through the departments, the free Excel template for an AI systems inventory (template in Spanish) works, with the EU AI Act risk category and the Annex III area in drop-down lists.
The module is a direct registration process, with no approval workflow (registering a system should not have to wait for anyone), with four blocks of fields, eleven rules that apply the logic of the Regulation as you fill it in, and a dashboard that answers “how much AI do we have and of what risk?”.
The Regulation defines an “AI system” by what it does, not by who sold it or whether it is paid for. In practice, an SME's inventory usually has four types of entries, and each one gets its record with purpose, provider, role and risk level:
Automatic number (IA-1, IA-2…), name, intended purpose, area of use (HR, customer service, marketing, finance, operations, security), the organisation's role (provider, deployer, importer, distributor), provider or product, base model, internal owner, registration date and status (under assessment, pilot, in production, withdrawn, prohibited).
Whether it processes personal data, data categories (identifying, financial, health, biometric, location, behaviour), DPIA carried out, affected persons (employees, customers, candidates, citizens, minors) and whether it makes automated decisions with effects on people. It is the bridge to the GDPR record of processing activities; data subject rights and breaches are managed in the GDPR rights and data breaches module.
Risk level (minimal, limited, high, unacceptable), Annex III category (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice), human oversight measures, Article 50 transparency, event logging, conformity assessment date, CE marking and applicable deadline.
Last and next assessment, recorded incidents, attached documentation (technical sheets, DPIA, assessments such as the fundamental rights impact assessment or FRIA under Article 27, contracts), remarks and the Regulation's application calendar in view.
Classifying as Unacceptable changes the status to Prohibited. The record reflects Article 5 on the spot, without anyone having to remember.
With High risk the Annex III fields appear: the category (mandatory), the conformity assessment date and the CE marking. With any other level they do not get in the way.
With Limited risk, Article 50 transparency is mandatory: a chatbot or a content generator is not saved without confirming that people are informed.
With personal data, the data categories appear and are mandatory; with automated decisions, the DPIA becomes mandatory.
A system in production needs a next assessment date. The inventory is not left without an owner or a calendar.
The list opens with four cards (high risk, in production, under assessment and with personal data) and a table filterable by area, risk, role, deadline, status and owner, exportable to Excel, plus a kanban view by status. The dashboard splits the inventory into six charts: risk level, area of use, status, role, registrations per month and automated decisions. Every change in a record stays in its history with user and date. When an auditor, a customer or the authority asks for evidence, the answer is the exported inventory, the documentation attached to each record and that history, not a spreadsheet rebuilt after the fact.
A good part of the AI a company uses comes from third parties: the chatbot in the customer service tool, the CV screening in the recruitment software or the scoring built into the ERP. Being purchased does not exempt you: if the system is high-risk, Article 26 requires the deployer to provide human oversight, data control and logs, and to comply you depend on what the provider delivers. Each record identifies the provider or product, the base model and your role, and keeps the technical sheet and the contract next to it; in high-risk systems, also the conformity assessment date and the CE marking.
The next assessment date turns the review of each critical provider into a scheduled commitment, and the history records who did it and when: it is the evidence of third-party risk management an audit usually asks for, without opening a separate project. If the risk that concerns you is the cybersecurity of your ICT providers, NIS2 and DORA also require you to know which third party was involved in each incident, and that is documented in the NIS2 and DORA incident register.
It is activated from the module catalogue of any Dokuflex account (“Regulatory compliance” group) and is installed in under a minute:
It is in the template catalogue as AI systems register (EU AI Act), within the “Regulatory compliance” group. To estimate the time it saves compared with a manual inventory, the ROI calculator does it without asking for an email.
The module is free in any Dokuflex account. If you also want to automate other processes, the Starter plan in Dokuflex pricing starts at €25/user/month with an annual subscription, and there is a free 14-day trial environment with no credit card.
Any organisation that uses AI, even purchased AI; these four profiles are the ones who ask for it first.
Candidate screening, performance evaluation, shift allocation: area 4 of Annex III and the most common in any company. The register documents the human oversight and the information to workers' representatives under Article 26.
Creditworthiness scoring, payment deferrals, pricing: area 5 of Annex III, with a fundamental rights impact assessment (Article 27) for credit institutions and insurers. Invoice OCR is also registered, even if it is minimal risk.
Chatbots, voice assistants, text and image generators: limited risk with Article 50 transparency enforceable from 2 August 2026. The module's rule does not let you save the record without confirming the notice to people.
Whoever answers a customer's questionnaire, an audit or the authority. The register cross-references the GDPR, surfaces shadow AI and keeps the history of each classification. If you automate with AI inside Dokuflex, the governed AI agents and the trust centre explain how oversight and traceability are applied on the platform itself.
The AI systems register and tools inventory is one of the free modules in the “Regulatory compliance” group of the Dokuflex catalogue. They all follow the same pattern: guided form, rules that turn the regulation into mandatory fields, evidence next to each record and change history. They are activated in under a minute and regulatory compliance management for the EU AI Act, GDPR, NIS2 or ISO 27001 stays on the same low-code BPM platform with AI, with data in the EU and support in English and Spanish:
If you also need risk analysis, ISO 27001 controls, business continuity or continuous supplier assessment, a GRC platform makes sense and can coexist with Dokuflex: the inventory exports to Excel and the platform connects with the rest of your stack through the low-code iPaaS with 200+ connectors and REST API.
Not under that name, but in practice yes. Regulation (EU) 2024/1689 imposes obligations that depend on each system (prohibitions, AI literacy, Article 50 transparency and high-risk duties) and, to know which ones apply and to prove it, you need an inventory with the risk classification of each one. The register is the evidence that this analysis exists and is up to date.
The provider develops the system and places it on the market or puts it into service under its own name; the deployer uses it under its own authority. Almost all companies are deployers of the AI they use. The high-risk provider carries the technical documentation and the conformity assessment; the deployer, Article 26 (human oversight, data control, monitoring, six-month logs, information to workers and affected persons). The module records the role in each record.
From 2 December 2027 for Annex III systems (employment, credit, education, biometrics, essential services) and from 2 August 2028 for those embedded in Annex I products, after the postponement under Regulation (EU) 2026/1744. The prohibitions apply from 2 February 2025 and Article 50 transparency from 2 August 2026.
The module automatically changes its status to Prohibited and records it in the history of the record. The Article 5 practices (social scoring, emotion recognition in the workplace, real-time remote biometric identification in public spaces, among others) have been prohibited since 2 February 2025 and carry the highest fines: up to 35 million euros or 7 % of worldwide turnover.
Yes. The module is installed as one more Dokuflex process and is edited with the low-code designer: add fields, change the lists of areas or data categories, adjust the rules or add an approval flow if your internal policy requires it. The fields and the eleven rules are a starting point, not a closed mould.
No, and be wary of anyone who promises it. Dokuflex provides the inventory, the guided classification, the rules that prevent omissions, the documentation next to each record and the traceability of each change; the classification of each system and the measures you adopt are decided by your organisation with its advisers. What the module does guarantee is that, when someone asks, the answer has a date, an owner and evidence.
Under a minute from the module catalogue of any Dokuflex account, including the free one. It comes with six sample systems and three guided tours; the samples are deleted when you register the real ones. The full inventory of an SME is usually done in an afternoon with a questionnaire per department.
For each system: name and intended purpose, area of use, provider or product and base model, the organisation's role (provider, deployer, importer or distributor), internal owner, personal data processed and persons affected, risk level and Annex III category if high, human oversight measures, Article 50 transparency, assessments carried out and attached documentation. These are the four blocks of fields in the module.
By the intended purpose and the people it acts on, not by the technology. There are four levels: unacceptable (Article 5 practices), high (purpose included in Annex III, except for the Article 6(3) exception), limited (interacts with people or generates content, Article 50) and minimal. In the module, choosing the level activates the mandatory fields for each case and the change stays in the history of the record.
Governance is the complete framework with which an organisation controls the AI systems it develops or uses. The AI systems register is its starting point and the first thing needed by those who mostly use purchased AI: inventory, risk classification, evidence next to each record and traceability of changes. In Dokuflex it is a free module within the BPM, extendable with the low-code designer.
No. Article 49 of the Regulation provides for an EU database in which certain high-risk systems are registered. The AI systems register is the internal inventory of all the AI you develop or use, with its classification and its evidence: it is what lets you know whether any of your systems must appear in that database and respond to the national authority (AESIA in Spain).
In Dokuflex, the AI systems register is a free module: it is activated in under a minute from any account, including the free one, with no card. You only pay if you want to automate other processes: the Starter plan starts at €25/user/month with an annual subscription, and there is a free 14-day trial environment.
Like any other system: the record identifies the provider or product, the base model and your role, which is almost always that of deployer. The technical sheet and the contract are attached next to it and, if the system is high-risk, the conformity assessment date and the CE marking are recorded. The next assessment date forces you to review each provider regularly.
Yes. The Regulatory compliance group of the Dokuflex catalogue includes, in addition to the AI systems register, free modules for GDPR rights and data breaches, NIS2 and DORA incident register, ISO 9001 and 27001 nonconformities and corrective actions and KYC file. They share platform, data in the EU and change history; they do not replace a GRC suite if you need risk analysis or business continuity.
It is advisable. The inventory should reflect the general-purpose AI tools used by staff and the AI functions embedded in company software (CRM, ERP, HR), even if IT did not buy them: if someone uses them with company data, Article 4 AI literacy and Article 50 transparency on generated content apply all the same, and without a record you cannot prove you have assessed it. In the module they are registered like any system, usually with the deployer role; the risk level is decided by your organisation in the record itself.
It covers the AI systems inventory that an AI management system (AIMS) under ISO/IEC 42001 needs as a starting point, with its purpose, role, risk, evidence and history, and it exports to Excel as evidence. It does not replace the full management system: AI policy, roles, impact assessment, internal audit and continual improvement remain the organisation's work.
It is the fundamental rights impact assessment under Article 27 of the Regulation. It must be carried out, before putting an Annex III high-risk system into use, by deployers that are bodies governed by public law or private entities providing public services, and by those who use high-risk systems to evaluate the creditworthiness of persons or for life and health insurance pricing. In the module it is attached to the system record next to the DPIA, and the next assessment date reminds you when to review it.
Yes. The register says which AI tools there are, who uses them and what risk they carry; the policy says who can use which, with what data, with what oversight and what is prohibited. The two feed each other: the policy requires each new tool to be registered and the register surfaces the shadow AI that the policy must regulate. The policy can be attached to the records as documentation, just like a DPIA or a contract.
Guidance prepared by the Dokuflex Editorial Team and reviewed by the Legal and Compliance Team. For specific cases consult your legal advisers or your national AI authority (AESIA in Spain).
Activate the free module, go through the six samples with the tour and register the first real system this afternoon. If you would rather see it with someone from the team, request a demo.