What is an AI inventory?
An AI inventory is a maintained record of every AI system and AI use case in an organization, including the tools staff adopted without asking. It records what each system is for, who owns it, what data it touches and which vendor sits behind it. Every common AI framework depends on it, because a system nobody has listed cannot be classified, assessed or governed.
What belongs in it
The system and its purpose, in a sentence somebody outside the team would understand. A row that says the name of a product and nothing else is a license record, not an inventory.
A named owner. A person, not a department and not a job title with nobody currently in it.
The data it touches, at the level of category, not field, and whether that includes personal data.
The vendor, and where it is possible to find out, the sub-processors behind that vendor.
A risk or impact tier, using whatever scheme your framework asks for, plus the reasoning. The reasoning is what makes the tier defensible later.
A date it was last reviewed. Without one, nobody can tell a current record from an abandoned one.
Why it is almost always incomplete
AI arrives through expense claims, browser extensions and free tiers, not through procurement. An inventory built by asking IT what was purchased will miss most of it.
The gap has a name people use, shadow AI, and the useful response is not a ban. It is a discovery step that runs on a cadence and a route by which someone can add a tool without being punished for having used it.
An inventory maintained once is a snapshot. What frameworks ask for, and what an auditor samples, is evidence that it stays current.
How it is used by each framework
Under the NIST AI RMF, establishing context is the MAP function, and context begins with knowing which systems exist.
Under ISO/IEC 42001, the life-cycle and impact-assessment control areas both assume an organization knows what it operates.
Under the EU AI Act, obligations attach by role and by how a system classifies. Classification happens per system, so an unlisted system has not been classified at all, whatever obligations it may carry.
Common questions
- Does a spreadsheet count as an AI inventory?
- Yes, if it is maintained, owned and dated. The failure mode is not the tool. It is a record that nobody owns and nobody has reviewed since it was created.
- Do we have to list every use of ChatGPT?
- List the use case, not every prompt. One row for a documented purpose, with an owner and the data it touches, is what a framework asks for. A hundred rows for a hundred individual sessions is unmaintainable and answers nothing.
- Who should own the inventory?
- One named person, with the authority to add a row without negotiating. Ownership that requires permission tends to lapse quietly, and a lapsed inventory looks identical to a current one until somebody checks a date.
Find out where you stand
The assessment on this site asks 24 questions against the framework you pick and returns a score, a verdict and, where a control is short, the one thing to fix first. It runs in your browser and takes about ten minutes.
It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.
Run the assessment