Use this when there is no AI register, or when the one that exists lists two tools and an internal model and nothing else. You get two files in a new folder, ./ai-system-inventory/: a spreadsheet you can open in Excel listing every use of AI in the company, one row per use, with its owner, the data it touches and who it affects (ai-register.csv), and a short notes document explaining what counts as AI, where each finding came from and the questions for each owner (inventory-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Every later AI governance step (classification, impact assessment, vendor review) reads this register, so a gap here is a gap everywhere.

Inputs to gather

Read before asking: the vendor or procurement list, expense or card exports for software, the single sign-on application catalogue, the product documentation and website feature pages, the code repositories the agent can reach, the data processing records, and any existing AI policy. Then ask the reader, in one message: which teams build or fine-tune models, which customer-facing features use AI, which teams are known to use AI tools without going through IT, and who will own the register.

Step 1: agree what counts as an AI system

Write the boundary test into the notes document (inventory-notes.md) before collecting anything. For the EU scope, use the definition in EU AI Act Art. 3(1) as the test: a machine-based system that infers from its input how to generate outputs such as predictions, content, recommendations or decisions, with some autonomy. Check the current consolidated text, since the Act was amended in 2026, and record in the notes which version you relied on. Rule-based scoring written by hand usually falls outside; a model trained on data usually falls inside. Record borderline cases with the reasoning instead of dropping them; a reviewer can move a borderline entry out later, but a missing entry stays invisible.

Step 2: discover from five sources

Search each source and tag every finding with where it came from:

Procurement and expenses: subscriptions to AI tools, and AI add-ons sold inside existing software (helpdesk, CRM, HR, recruiting, note-taking, meeting transcription).
Single sign-on and browser extensions: assistants and writing tools people connected themselves.
Code: model provider SDKs, calls to model APIs, model files, vector databases, notebooks, fine-tuning jobs.
Product: features described as smart, predictive, generated or automated on the website and in release notes.
People: ask two or three team leads per department what they use AI for. This is where shadow use shows up.