A small company can track EU AI Act work in five spreadsheet tabs: AI inventory, role and risk classification, AI literacy log, transparency notices and a high risk documentation tracker. It stops working when AI use spreads faster than the sheet is updated or when high risk systems need logs and records that nobody can export by hand.
Tab 1: AI inventory
One row per system or feature: name, vendor or in house, purpose, users, affected people, data types, owner, date added, date last reviewed. The point is discovery. Ask every team, check expense reports for new AI subscriptions, and scan code and dependencies for model libraries.
This tab fails first. It depends on people telling you, and AI features arrive silently through software updates. If the "last reviewed" column has gaps, the rest of your classification is built on sand.
Tab 2: role and risk classification
Add columns: provider or deployer, prohibited check (yes or no and who checked), tier (unacceptable, high, limited, minimal), reason, Annex reference if high risk, date, reviewer. A provider who decides an Annex III system is not high risk must document that assessment before placing it on the market, so this tab carries a legal record. Keep the reasoning in a linked memo, not a cell.
Tab 3: AI literacy log
Article 4 asks providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others using AI on their behalf, taking into account their knowledge, the context and who is affected. Columns: person, role, AI systems used, training given, date, content version. Role based content beats one generic course.
Tab 4: transparency
Columns: interface, where AI is used, notice text, date live, screenshot link, owner. Article 50 requires that people know when they interact with AI and that deepfakes are disclosed. Systems already on the market have until 2 December 2026 for Article 50(2) per the tracker page we fetched.
Tab 5: high risk files
For each high risk system, list the obligations the summary names for providers: risk management, data governance, technical documentation and logging, instructions for use, human oversight, accuracy, robustness and cybersecurity, a quality management system, conformity assessment and registration. Add status, owner, document link and due date. On the tracker, Annex III obligations start 2 December 2027 and Annex I obligations 2 August 2028, but confirm in the official text because dates have moved.
Where does the spreadsheet approach break?
Logging is the clearest case. A spreadsheet can record that a system has logs, but it cannot keep them. Documentation drift is the second: a model changes and the file says otherwise. The third is volume: dozens of AI features, each with a vendor who changes terms.
When to automate
Look for these signs: you cannot answer "which AI do we use" in a day; a model or vendor changed and you learned from a customer; high risk work needs evidence that comes from systems, not from people. Automate discovery, evidence capture, reminders and change alerts. Keep classification decisions, legal reasoning and sign off with named people.
Mistakes to avoid
- One owner for the whole sheet. Give each row an owner.
- Overwriting history. Keep dated versions.
- Treating the sheet as the compliance work. It records the work.
What to do
- Create the five tabs and a version history tab.
- Run a discovery sweep across teams, spend and code.
- Classify each row and write memos for borderline cases.
- Start the literacy log with role based content.
- List every user facing AI interface and add notices.
- For high risk systems, assign owners to each obligation.
- Review the sheet monthly and compare against the dates tracker.
Quick check
Is a spreadsheet enough for a small company?
Often yes at first, if the inventory is small and each row has an owner. Move on when discovery or evidence becomes the bottleneck.
Who decides our risk tier?
You do, as provider or deployer, with documented reasoning. Ask counsel to review borderline cases. The sheet does not make the decision.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the repeating parts of this tracking can be collected from connected systems and code instead of by screenshot. Technical evidence comes from your real code and dependencies: scans and SBOMs show which model libraries and services your software uses, which feeds the inventory tab. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready. It does not classify your risk tier or give legal advice. Book a call.
Sources
- EU AI Act implementation timeline, fetched 18 October 2026.
- EU AI Act high level summary, fetched 18 October 2026.
- Article 4, AI literacy, fetched 18 October 2026.
This is general information, not legal advice.
Last reviewed: 18 October 2026.
