AI Inventory

Most organizations cannot answer a simple question: what AI are we using? AI arrives through many routes. Data science teams build models, employees sign up for AI tools, vendors add AI features to software the organization already owns, and AI agents are connected to internal systems. Without a central record, leaders cannot assess risk, meet regulatory obligations, control costs or measure value. An AI inventory provides that record. It lists every AI system in scope with the information needed to govern it. It is also the basis for answering questions from regulators, auditors, customers and the board.

An inventory is usually the first step in AI governance, and many frameworks and laws depend on it. Organizations preparing for the EU AI Act need to know which of their systems are high-risk. US federal agencies have been required to publish inventories of their AI use cases. ISO 42001 and the NIST AI Risk Management Framework assume the organization knows its AI systems. For risk, compliance, technology, finance and procurement leaders, an AI inventory turns AI from scattered activity into a portfolio that can be managed.

Definition of AI Inventory

An AI inventory is a maintained catalog of all AI systems and use cases within an organization's scope, including internally developed models, procured AI products, AI features embedded in other software and AI agents, with structured information about each system's purpose, ownership, data, vendors, risk classification, controls, costs, benefits and lifecycle status.

It is the foundation of AI governance, supports AI portfolio management and helps bring shadow AI under control.

What an AI Inventory Records

Identification covers the system's name, description, version and whether it was built, bought or embedded in other software. A unique identifier makes it easy to link the system to assessments, incidents and contracts.

Purpose and use cover what the system does, which business processes and decisions it supports and who uses it. This information is essential for judging risk, since the same tool can be used in very different ways.

Ownership covers the business owner, technical owner and any vendor. Every system should have a named business owner accountable for its use.

Data covers the types of data used for training and input, including personal, confidential or regulated data.

Risk covers the risk tier, regulatory classification, assessments completed and controls in place.

Cost and value cover licenses, usage and infrastructure costs, and the expected and actual benefits.

Status covers where the system is in its lifecycle, from proposed to in use to retired, and the date of its last review.

What Counts as AI in Scope

Internally developed models are in scope, including machine learning models and applications built on large language models.

AI products and services bought from vendors are in scope, such as chatbots, coding assistants and analytics platforms.

AI features embedded in existing software are in scope, even though vendors may switch them on without a new purchase.

AI agents that can take actions in systems, such as sending messages, updating records or making purchases, are in scope.

Organizations should define scope clearly, so teams know what must be registered. Clear examples of what is and is not in scope help teams apply the definition.

Importance of an AI Inventory in AI Governance

An AI inventory creates visibility. Leaders can see how much AI the organization uses, where and for what. Many organizations are surprised by how much AI they already use.

It enables risk management and compliance. Risk tiers, assessments and regulatory obligations can only be applied to systems the organization knows about. An incomplete inventory means some risks are not managed at all.

It also supports value management. Recording costs and benefits lets leaders compare AI investments and decide which to expand, fix or retire.

AI Inventories and Financial Management

Recording license, usage and infrastructure costs for each system gives a complete view of AI spending, supporting AI cost management.

Inventories often reveal duplicate tools bought by different teams, which can be consolidated to save money.

Linking each system to its expected benefits makes it possible to track AI value realization over time.

Knowing which systems are high-risk helps budget for the testing, monitoring and compliance work they require.

Common Challenges

Finding all AI in use is difficult, especially embedded features and tools adopted by individual teams. Using several discovery methods together gives the most complete picture.

Inventories go stale quickly if they depend on people remembering to update them. Linking registration to purchasing and project approval keeps entries current.

Different teams may define AI differently, leading to inconsistent coverage. A shared definition with examples avoids gaps and duplicate entries.