AI Inventory for external data protection officers

For the external DPO who looks after several companies: a Notion template for each client to organise which AI it uses, with which personal data and which article of the AI Act each item cites.

If you are an external data protection officer, your clients are already asking you about artificial intelligence: the chat assistant that serves their customers, the tool that screens CVs, the automatic meeting summaries. Many of those tools process personal data, and that is where the record of processing activities and the EU AI Act meet.

The AI Inventory is the Notion template in which each client keeps its AI systems with the same starting data you need for the GDPR: provider, purpose, whom it affects and what data it processes.

39 USD plus any applicable taxes, calculated by the store Get the template

What it is for

• Start from an organised list of each client’s AI systems, rather than a different spreadsheet in every company.
• See which systems process personal data or special categories of data, to match them against the record of processing activities.
• Go through the obligations, the prohibited practices and the timeline of the AI Act with the client, preloaded with their article, the link to the official text and the date they were checked.
• Keep the evidence (provider instructions, notices, training) linked to each system.

Each purchase is for one company: your client duplicates it into its own Notion workspace and we do not see its data. The template organises the information and cites the article; how it applies to each case is for you and your client to decide.

What the AI Act asks of those who use AI

The EU AI Act has no article requiring those who use AI (the "deployer") to keep a record with fixed contents, like the GDPR record of processing activities. What it does ask of them rests on knowing which AI systems they use, for what and whom they affect. These articles explain it, with the article of the Act and the official source of each item:

• AI Act and GDPR: which record you need for each
• Record of processing activities in Notion: what columns Article 30 requires
• Is your company a deployer? Five questions
• High-risk AI systems an SME may be using without knowing it (Annex III)

What the template includes

• AI systems: The third-party AI systems the company uses, what for, who they affect and what the Regulation asks of them (indicative).
• Providers: The companies that supply the AI systems.
• Deployer obligations: What the AI Act requires from deployers, with the article and the date it applies from.
• Prohibited practices (Art. 5): The AI practices prohibited by Article 5 of the AI Act, with the date they apply from and the official text linked.
• AI Act timeline: The application dates of the AI Act as set by Regulation (EU) 2026/1744, with the article and the official text linked.
• Classification (Art. 6 and Annex III): The Article 6 rules for telling whether an AI system is high-risk and the eight Annex III areas, with the article and the official text linked. The areas have no date of their own: the Article 6(2) row says from when that rule applies.
• AI literacy (Art. 4): The AI training activities for staff and the systems they relate to.
• Evidence: Contracts, instructions, notices and records that document how the systems are used.

The preloaded rows, their sources and the dates they were checked, on the template page: AI Inventory.

Price

39 USD plus any applicable taxes, calculated by the store Get the template

You pay once on Gumroad and duplicate it into your Notion workspace from the purchase link.

The free sample

The free sample, EU AI Act timeline, includes part of the Inventory’s preloaded content and will be available soon. The application dates of the EU AI Act, the practices prohibited by its Article 5 and the deployer obligations, with their article and the official text linked.

Document organisation tool based on official texts; it does not constitute legal advice.