The inventory somebody already keeps
Nearly every organization starts with a spreadsheet of products and systems. Columns are matched by header name — only name is required; kind, description, criticality, owner, email, version are picked up when present, along with the obvious synonyms (product, service, asset, component).
Everything arrives unclassified, deliberately. Whether a product has digital elements and falls under the CRA, or whether you are an essential or important entity under NIS2, is a determination with legal consequences. The import gets the inventory in; you mark scope yourself, with your reason recorded beside it.
A row with an unrecognized criticality is recorded as medium rather than guessed at.
From your directory: Microsoft Entra ID (Azure AD) and other exports
In the Microsoft Entra admin center, Devices › All devices › Download devices writes a CSV of your devices. Upload it here: each device becomes an internal system with its operating system, version and owner. The device id is kept, so importing next month's export updates the same rows instead of adding new ones; your scope decisions are never touched. For an Intune, Microsoft 365 or any other export, choose "Another export" and type its column names.