What is an AI inventory?
An AI inventory is a maintained register of every AI system a company builds, buys, or uses, with enough detail to govern each one. It covers in-house models, vendor AI products, AI features inside software such as the CRM, agents, automations, and the public tools staff may use. Each entry describes a use rather than a product, because one licensed model can draft marketing copy in one department and screen loan applications in another, with very different risks.
A model registry tracks model versions for engineers. The AI inventory records what each system does for the business, who answers for it, and how risky it is.
How an AI inventory works
A useful entry covers four areas:
- Purpose and owner. The entry names the business process the system supports and the person accountable for it.
- Model and hosting. It records the model, its version, the vendor, and where inference runs.
- Data and connections. It lists the data the system reads, the systems it can change, and the actions that need human approval.
- Risk and review. It gives a risk tier, any regulatory classification, links to documents such as the model card, and a review date.
The first version comes from purchasing and expense records, single sign-on and OAuth app grants, network logs, vendor release notes, and department interviews. That search usually turns up shadow AI. Keeping the list current means tying it to procurement, the AI acceptable use policy, and an intake process, so new tools are recorded before they go live. The NIST AI Risk Management Framework calls for an AI inventory, and risk classification under the EU AI Act starts from one.
AI inventory in practice
A county government builds its first AI inventory after commissioners ask how departments use AI. IT starts with purchasing records and sign-on logs, then surveys department heads. The first pass finds a chatbot on the county website, video analytics on traffic cameras, and transcription of public meetings. It also finds an applicant-screening feature switched on in the HR system and caseworkers drafting letters in personal chatbot accounts. The screening feature gets the highest risk tier because it affects hiring, so it stays off until HR documents a human review step. Caseworker drafting moves to an approved tool that keeps client records inside the county’s environment.
What to watch for
- Include AI features that vendors add to existing software, because they often arrive in routine updates without a contract review.
- Give every entry a named owner and a review date, since an inventory nobody maintains goes stale within months.
- Record agent permissions in detail, because the systems an agent can change determine most of its risk.