Governance & Accountability ยท GOV-06
AI inventory
The organisation keeps a current inventory of the AI it uses, including AI built into bought products and services, with enough detail to govern it.
Why it matters
An organisation cannot govern, secure or explain AI it does not know it has. A growing share of AI arrives inside products already in use, so an inventory of in-house builds alone gives a false sense of control.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No inventory; knowledge of what AI is in use is scattered or absent. |
| 2 Developing | A partial list exists, usually of in-house projects, missing AI embedded in bought products or used informally. |
| 3 Defined | A maintained inventory covers in-house, procured and embedded AI, with the details needed to govern each entry and links to its models, data and integrations. |
| 4 Managed | The inventory is reconciled against procurement, technology and data records, and its completeness is measured. |
| 5 Optimising | The inventory feeds portfolio, risk and transparency reporting automatically and is used as the organisation's single view of AI. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-06.1 A maintained AI inventory covers in-house, procured and embedded AI.
- GOV-06.2 Each inventory entry records its purpose, owners, risk tier and status.
- GOV-06.3 Each inventory entry records its regulatory risk classification and the reasons for it.
- GOV-06.4 Each inventory entry records the supplier or source of the use and of its components.
- GOV-06.5 Each inventory entry is linked to its models, data sets and integrations.
- GOV-06.6 For each agent, the inventory records the tools, systems and data it can act on, and what it can do without a person's approval. AGT
Assessment questions
- Is there a list of the AI in use, and who keeps it up to date?
- Does it include AI built into products and services you have bought?
- How would a new use of AI get onto it?
- For each agent: the tools, systems and data it can act on, and its approval thresholds
- The inventory itself, with a recent update date
- The process or form that adds and removes entries
- Regulatory classification and reasons recorded against inventory entries
How to reach Level 3
- Set up an inventory with fields for purpose, owners, risk tier, regulatory risk classification with reasons, status, and the supplier or source of the use and its components.
- Find AI in use by asking teams, checking procurement and licence records, and reviewing products with built-in AI features, covering in-house, procured and embedded AI.
- Link each entry to its models, data sets and integrations, using existing data and system catalogues where they exist (see DAT-04 and TEC-04).
- Name an inventory owner and make updating it part of go-live, change and retirement (POR-03 and POR-09).
Common pitfalls
- Missing AI built into everyday products such as office suites and service platforms.
- Building the inventory once and never updating it.
Starter artefacts
- AI inventory template with required fields
- Discovery questionnaire for teams and suppliers
Ownership and sequence
- Accountable
- ai governance lead
- Contributors
- delivery lead, security lead, business owner
- Depends on
- GOV-01
- Roadmap step
- 3
- Lifecycle
- acquire_build, deploy, operate, retire
Cross-references
| AI Cyber Security Code of Practice | 5.1 direct |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 1 Summary information direct; Tier 2 Description and rationale partial; Tier 2 Tool specification partial; Scope tools in scope partial; Scope timing and updates partial |
| EU AI Act | Art 6 direct |
| ISO/IEC 42001 | A.4.2 partial; A.4.3 direct |
| JSP 936 Part 1 | para 13 partial; para 39 direct; para 88 partial; para 104 direct |
| NIST AI 600-1 | R12 partial |
| NIST AI RMF 1.0 | GOVERN 1.6 direct; MAP 1.1 partial; MAP 2.1 partial; MAP 3.3 partial |
| UK Data and AI Ethics Framework | Transparency 2 partial; SAT 1.2 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.