EU AI Act Risk Inventory Workflow: n8n + OpenAI + Sheets

Automate your EU AI Act risk inventory—collect submissions, classify risk with OpenAI, log to Google Sheets, and email the right stakeholders

This EU AI Act Risk Inventory Workflow for n8n turns an internal AI system submission into a structured risk-classification record: it gathers details via an n8n Form, uses OpenAI (gpt-4.1-mini) to propose an EU AI Act risk class and obligations, stores the result in Google Sheets, and notifies management (CC the DPO) when a case is prohibited, high-risk, or unclear.

What this workflow does

• Receives an AI system submission through an n8n Form trigger (purpose, data types, decision impact, and external visibility).
• Normalizes the submission, generates a report ID, flags potential Annex III areas using keyword matching, and checks whether Art. 50 transparency may apply.
• Calls OpenAI with the normalized report to propose, in strict JSON, the EU AI Act risk class, relevant provision, reasoning, obligations, and open questions.
• Validates and corrects the proposal: rejects unknown classes, escalates to Annex III high risk when pre-check keywords indicate it, and adds Art. 50 transparency obligations when output leaves the company.
• Appends a record to Google Sheets into an “AI inventory” spreadsheet with status like “Proposal - human review pending” and the proposed classification details.
• Sends email via SMTP: for prohibited, high-risk, or unclear submissions, it notifies management and CCs the DPO; otherwise it schedules the entry for periodic review with a next-review date.

Use cases

• Centralizing EU AI Act documentation for SaaS teams using n8n and Google Sheets.
• Rapid triage of new AI features by auto-producing a risk-classification draft for human review.
• Escalating potential high-risk or prohibited cases to management and the DPO with audit-ready data.

Technical details

• Integrations: n8n Form, OpenAI (gpt-4.1-mini), Google Sheets, SMTP email.
• Workflow logic nodes: if, set, code, switch, no op, email send.
• Key behavior: keyword-based Annex III pre-check + strict JSON proposal + validation/correction before storing and notifying.