AI inventory

In one paragraph

An AI inventory is a list of every AI system an organisation uses, what each one does, who is responsible for it, and what data it touches. It sounds simple, and most organisations assume they already have one, but a proper inventory is built by looking for AI systems rather than asking people to declare them, because a surprising number are running quietly inside software that was bought for another purpose. It is the first thing almost every rule and standard on AI asks an organisation to produce.

Why it matters

You cannot govern, secure, or measure what you cannot see. Rules and standards on AI, wherever they come from, tend to start with the same question: what AI do you run, and what does it do? An organisation that already has a current inventory can answer that quickly and move on to the harder work. One that does not has to build the inventory under pressure, often while also trying to satisfy whoever is asking, which is a worse position to be in than having the list ready in advance.

How it works

Each entry in an AI inventory records:

• Purpose: what the system is for, and the decision or task it supports.
• Owner: the person or team accountable for it.
• Data touched: what information it reads, and how sensitive that information is.
• Where it runs: whose infrastructure it sits on.
• Who can use it: which people or roles have access.
• How it is checked: what testing or review keeps its behaviour under watch.

The inventory is built by finding systems, including AI features that arrived quietly inside software bought for something else, rather than by asking teams to list what they know about. Once a system is on the inventory, it can be classified against whichever rules apply to it, such as the EU AI Act or a structure like ISO/IEC 42001. The inventory is not a one-off document: it is kept current as systems are added, changed, or retired.

What it looks like in practice

Organisations that set out to list their AI systems usually expect to find a handful. Alongside the assistant a team built deliberately, the review turns up a drafting feature switched on inside an existing piece of software, a scoring tool inside a recruitment system, and a summarising feature in a document platform that nobody had formally approved. None of these were hidden on purpose. They simply arrived as updates to tools already in use, which is exactly why looking for AI systems finds more than asking about them does.

How this connects to our work

Building and keeping the inventory current is the starting point for answering the rules that apply to your organisation, and it is part of the policy and record-keeping that comes with a private AI setup. Everything that follows, classification, policy, and evidence, is built on top of it.