Guides · Organisation · Governance
Building an AI system inventory in 30 days
An unlisted AI system cannot be governed, assessed or switched off. The inventory is the first artefact an auditor, an enterprise buyer or a regulator will ask for, and it is faster to build than most organisations expect.
Why the inventory comes first
Every governance framework you might adopt, from the NIST AI Risk Management Framework to ISO/IEC 42001 to an EU AI Act compliance programme, begins with the same question: what AI systems do you operate? If you cannot answer it, nothing else in the framework can be applied. Policies have nothing to attach to. Impact assessments have no subject. Monitoring has no target.
The inventory is also the question that arrives from outside first. Enterprise procurement questionnaires now routinely ask for a list of AI systems that process the buyer's data. Under the EU AI Act, providers and deployers of high-risk systems must be able to identify them. An auditor working to ISO/IEC 42001 will ask for the register on day one.
In the organisational indicator, the risk and governance dimension cannot score above two without a maintained inventory with a named owner for each system. It cannot score above three unless the inventory gates deployment.
What each entry records
Keep the first version to the fields that answer the questions you will actually be asked. You can extend it later. Each entry needs:
| Field | What it answers | Example |
|---|---|---|
| System name and vendor | What is it, and whose model is underneath | Contract summariser, Azure OpenAI GPT-4o |
| Business owner | Who is accountable for its outcomes | Head of Legal Operations |
| Technical owner | Who can change or switch it off | Platform team lead |
| Users | Which teams or customers use it | Legal, Procurement |
| Data touched | Personal, customer, confidential, public | Customer contracts, counterparties' personal data |
| Decisions it informs or makes | Where a human is and is not in the loop | Flags clauses for review, decides nothing alone |
| Account type and terms | Company-managed, no-training and retention terms confirmed | Enterprise agreement, 30-day retention, no training |
| Status and review date | Pilot, live, retired; when it was last reviewed | Live, reviewed 2026-09-01 |
Week one: find what exists
Do not start with a survey. Start with the systems that already know. Finance can list every AI vendor that invoices you. Identity management can list every single sign-on application with AI in its name or description. Expense reports reveal the personal subscriptions people bought because the approved tools were slow to arrive. Network and proxy logs show which AI domains are in daily use.
Then run the survey, but keep it to two questions: which AI tools do you use for work, and what do you use them for. Make it anonymous for this round. You are counting, not policing, and the first inventory that triggers consequences is the last honest one you will get.
- Include AI embedded in software you already pay for. Salesforce, Workday, ServiceNow and Microsoft 365 all ship AI features that process your data.
- Include coding agents and workflow platforms. They take actions, which makes them higher risk than chat.
- Include the things that were built in-house and never written down.
Week two: name an owner for everything
Every entry gets a business owner and a technical owner, both named individuals, both told. An inventory with a column marked "Shared" or "IT" is not an inventory. The test is simple: if this system produced a harmful output tomorrow, who would be called, and who could switch it off within the hour.
Expect friction here. Systems that nobody wants to own are usually systems nobody should be running, and the second most valuable output of this week is the list of tools to retire.
Week three: record what each system touches and decides
For each system, record the classes of data it reads and whether that data is pseudonymised before the model sees it. Then record what the system decides. The useful distinction is between informing a human decision, making a decision a human reviews, and acting without review. Anything in the third category involving customers, people decisions, or legal or financial consequences for third parties needs flagging now, because that is where the heaviest obligations sit.
This is also the week to confirm account terms. Personal accounts and consumer tiers usually permit training on inputs and retain data indefinitely. Company agreements with no-training and retention terms confirmed in writing move a system from a liability to a managed asset without changing a line of code.
Week four: make it gate deployment
An inventory that is updated after the fact decays within a quarter. The version that lasts is the one that sits in the path of deployment. Add a step to whatever process already approves new software, new vendors or new production changes: no entry in the register, no go-live. Attach a short impact assessment to the entry for anything that touches personal data or makes decisions.
Set a review cadence, quarterly for live systems, and put the review date in the entry. Publish the inventory internally. People are far more likely to register a tool when they can see that everyone else has.
What changes once it exists
With the inventory in place, the rest of the governance dimension becomes tractable. You can write a policy about what AI must never decide alone and point it at specific systems. You can choose an external framework and know what evidence you already hold. You can answer the procurement questionnaire in an afternoon rather than a fortnight.
It also changes the conversation with your board. An inventory turns "we are using AI" into a count, a set of owners and a known exposure, which is the first form of AI reporting most boards find they can actually act on.