AI System Inventory
A maintained register of the AI systems an organization develops, buys or uses, recording owners, purposes, data, risk level and status.
Risk classification, EU AI Act obligations and ISO/IEC 42001 controls all depend on knowing which AI systems exist; without an inventory, unapproved tools and vendor AI features go unassessed and accountability for them stays unclear.
A 200-person firm surveys departments and reviews SaaS invoices, finds 34 AI uses including 9 unapproved chat tools, records owner, purpose, data categories, vendor and EU AI Act risk class for each, and reviews the register every quarter.
Inventories go stale quickly as vendors add AI features to existing software, and self-reported surveys miss Shadow AI. A register is only useful when each entry links to assessments, controls and an accountable owner rather than serving as a static list.
The NIST AI RMF Playbook describes an AI system inventory as an organized database of artifacts about each system, such as documentation, data dictionaries, incident response plans, links to code and responsible contacts. Typical fields add intended purpose, deployment context, data sources, risk tier and lifecycle stage. The register defines the scope of an AI Management System and supports EU AI Act roles, for example identifying which high-risk systems must be registered in the EU database under Article 49.
Cybersecurity, Data Engineering
NIST AI Resource Center — AI RMF Playbook: Govern (GOVERN 1.6) — https://airc.nist.gov/airmf-resources/playbook/govern/; EU Artificial Intelligence Act — Article 49: Registration — https://artificialintelligenceact.eu/article/49/