Your first algorithm inventory: AI Act and ATRS readiness

Most public bodies already use more automated tools than anyone has written down: a chatbot on the website, a model that sorts incoming post, a supplier’s risk score inside a case management system. Some of those tools will fall under the EU Artificial Intelligence Act, Regulation (EU) 2024/1689. In the UK, many central bodies must describe theirs under the Algorithmic Transparency Recording Standard (ATRS). Both start in the same place: knowing what you use.

This piece sets out a practical inventory. The full picture of the rules is in the guide to AI in public administration.

Why now

The AI Act applies in stages. Its prohibited practices, including social scoring, have applied since 2 February 2025, and its transparency duties for systems that interact with people apply from August 2026.³ The high-risk rules for the uses listed in Annex III were pushed back by the 2026 Digital Omnibus on AI, Regulation (EU) 2026/1744, and now apply from 2 December 2027.²

That gives public bodies time, but not much. A fundamental rights impact assessment has to be done before a high-risk system is first used, and some contracts and procurements running today will still be in place in 2027.

What to record for each tool

A starter set of inventory fields
Field	Why it matters
Name, owner and supplier	Someone must be accountable, and supplier documentation feeds every later assessment
What it does, in one sentence	Separates narrow tasks, such as routing letters, from tools that shape decisions
Decisions it touches	The key question for Annex III and for the right to an explanation
People affected	Staff only, the public, or a specific group such as benefit claimants
Data used	Sources, definitions and quality; also needed for data protection assessments
Human oversight	Who reviews the output, and whether they have the time and authority to overrule it
Does it profile people?	Profiling changes how the AI Act classifies a system
Transparency	Whether people are told it is in use, and where a public record sits

Checking each entry against the AI Act

With the inventory in hand, three checks sort most entries:

Is it prohibited? The Act bans social scoring: evaluating or classifying people over time on their social behaviour or personal characteristics where the score leads to unjustified or unrelated unfavourable treatment.¹
Is it in an Annex III area? Several sit at the heart of public administration, including evaluating eligibility for essential public assistance benefits and services, classifying emergency calls, deciding access to education and assisting asylum and visa decisions.¹
If so, is it really high-risk? An Annex III system can fall outside the category if it doesn’t pose a significant risk of harm, for example because it performs only a narrow procedural or preparatory task, but a system that profiles people always counts as high-risk.¹

For anything that ends up high-risk, the inventory becomes the start of a longer file. Public bodies deploying such systems must assign human oversight to competent people, register their use in the EU database, tell the people affected, and carry out a fundamental rights impact assessment before first use.¹ Since the 2026 amendments, that assessment can cross-refer to an existing data protection impact assessment rather than repeat it.²

Using the same inventory for the ATRS

In the UK, the ATRS gives public sector organisations a standard way to publish information about how and why they use algorithmic tools. It is mandatory for all government departments and for arm’s-length bodies that deliver public or frontline services or deal directly with the public, and the Data Standards Authority recommends it across the wider public sector.⁴

The fields above map closely onto what an ATRS record asks for: what the tool is, why it is used, how it fits into decisions, what data it relies on and who oversees it. Building the inventory once and publishing from it saves doing the same work twice.

The part people skip: data definitions

The “data used” field is where inventories usually go thin. Recording that a model uses “income” or “household size” isn’t enough if two source systems define those terms differently, because the model will learn the confusion. Writing down which definition each source uses is a semantic interoperability task, and it pays off twice: in better results, and in assessments and transparency records that can actually explain what the tool relies on.

First steps this quarter

Ask every team and supplier to list automated tools in use, however small.
Record the starter fields for each, with a named owner.
Run the three AI Act checks and flag anything in an Annex III area.
For UK bodies in scope, compare the list with your published ATRS records.
Agree a review date, because tools and contracts change faster than policies.