Ask a small UK business how many AI tools it uses and the first answer is usually "one or two". Then the list grows: the chatbot on the website, the meeting note-taker someone switched on, the AI feature that arrived in the accounts software, the CV-screening option in the recruitment platform, and whatever staff paste into a free chatbot at lunchtime. If you cannot name every tool and say what personal data it touches, you cannot show that you are handling that data lawfully.
This article walks through a simple, one-page AI inventory: what to record, why each column matters under current UK rules, and how to keep it as evidence.
Why "we don't really use AI" is not an answer
The UK has not passed an AI Act. That does not mean AI use is unregulated. When an AI tool processes personal data about customers, staff or job applicants, UK data protection law applies to that processing in the same way it applies to any other system. The ICO publishes guidance on AI and data protection, and it states on that guidance page that it is under review because of changes made by the Data (Use and Access) Act 2025.
One of those changes is now in force. Section 80 of the Data (Use and Access) Act 2025, which replaced UK GDPR's old Article 22 on automated decision-making with new Articles 22A to 22D, was brought into force on 5 February 2026 by the Commencement No. 6 Regulations (SI 2026/82). The ICO's summary explains the effect: for significant decisions made by automated means, organisations can now rely on a wider range of lawful bases, so long as they apply appropriate safeguards, but this does not apply to special category data, which remains more protected.
That distinction only helps you if you know which of your tools make or influence decisions about people, and what data they use. That is what the inventory is for.
The one-page AI inventory: six columns
Use one row per tool. A spreadsheet is fine.
- Tool and vendor. The product name and the company behind it, including AI features inside software you already pay for.
- What you use it for. One plain sentence, such as "drafts replies to customer emails" or "ranks job applicants".
- Does it touch UK personal data? Names, emails, call recordings, CVs, customer histories. If yes, data protection law applies to that use.
- Does it make or influence a significant decision about a person? Hiring shortlists, credit, pricing for an individual, access to a service. These are the uses the new Articles 22A to 22D are about.
- Is special category data involved? For example health, ethnicity, religion or trade union membership. This is the area where the rules did not loosen.
- Owner and review date. Who is responsible for the tool and when you will check the row again.
How to find the tools you have forgotten
- Check your software subscriptions and recent card statements for AI add-ons and new features.
- Ask each member of staff, without blame, which AI tools they use for work, including free ones on personal accounts.
- Look at your website: chat widgets, form tools and booking systems often include AI features.
- Check your recruitment process end to end, including any job board or applicant-tracking platform.
What to do with the finished list
For most small businesses, most rows will be low risk: AI that drafts text with no personal data, or that never decides anything about a person. The rows that need attention are the ones where personal data goes in, and especially any row where the tool shapes a significant decision or uses special category data. For those, check what the vendor does with your data, whether a person genuinely reviews the outcome, and how someone affected could question it.
Then keep the evidence: the dated inventory, a short note of each decision you made about a tool, and the date of your next review. The ICO's guidance on automated decision-making is being updated, so diarise a check rather than assuming today's answer will last.
The guide that sets this out step by step
AI Compliance for Small Business (UK Edition) explains the UK GDPR changes in plain English and includes printable worksheets: an AI inventory log, an Article 22 classification tool, a vendor due-diligence questionnaire and a ready-to-adapt AI use policy, plus a 30-day plan. Also available on Amazon.
Explore the guide and instant PDF download.
Know what changed. Know what to do. Keep the proof.
📘 PDFBlueprints — plain-English UK compliance guides for landlords, sole traders & small employers. Checklists, trackers & templates. Instant PDF. General information, not legal advice. Commencement checked against legislation.gov.uk (SI 2026/82) and the ICO's Data (Use and Access) Act and AI guidance pages on 23 October 2026. Guidance is changing, so verify current requirements and take qualified advice for your situation.