Every AI governance programme starts in the same place: finding out what AI you actually have. An AI inventory, sometimes called an AI register, is a living list of every AI system your organisation builds, buys or uses. Without it you can’t assess risk, apply the EU AI Act or answer a customer’s security questionnaire.
Why it’s harder than it sounds
AI is no longer just the projects your data team builds. It hides in:
- SaaS features switched on by default, such as AI summaries in your CRM, help desk, video calls and office suite.
- Tools staff signed up for themselves, such as chatbots, transcription apps and browser extensions. That’s shadow AI.
- Vendor products where the AI isn’t obvious, such as fraud detection, CV screening and chat widgets.
- Internal scripts calling AI APIs.
Step 1: Agree what counts as “AI”
Keep it practical. Include any system that generates content, makes predictions, recommendations or decisions, or classifies people or data using machine learning or large language models. If in doubt, include it. It’s easier to remove an item than to discover a missed one in an audit.
Step 2: Find the AI
Use several sources, because no single one catches everything:
- Ask every team with a short survey: what AI tools do you use, and for what?
- Check procurement and expense records for AI subscriptions.
- Review SaaS admin panels for AI features and whether they’re on.
- Ask IT and security for data from network, browser or SSO logs about AI services.
- Ask engineering about AI APIs and models in your products and scripts.
Step 3: Record the essentials
For each system, capture:
- Name and vendor (or “built in-house”)
- Owner: the person accountable for it
- Purpose: what it’s used for, in one sentence
- Users and affected people: staff, customers, applicants and so on
- Data: what goes in, especially personal or confidential data, and where it’s processed
- Decision impact: does it inform or make decisions about people?
- Your role: provider or deployer
- Risk level: your initial classification, such as minimal, transparency or high risk (see EU AI Act risk categories)
- Status: in use, pilot or retired
- Last reviewed: a date
A spreadsheet is fine to start. You don’t need special software for the first version.
Step 4: Triage by risk
Sort the list so attention goes where it matters. First look at anything that:
- Makes or supports decisions about people’s jobs, money, health, education or access to services
- Processes sensitive personal data
- Is customer-facing
- Might be a prohibited practice, such as emotion recognition at work
Those get a proper risk assessment first.
Step 5: Keep it alive
An inventory that’s out of date is worse than none, because it gives false confidence. To keep it current:
- Make “add it to the inventory” a required step in buying or building any AI, through your AI acceptable use policy.
- Review it every quarter with each owner.
- Re-check SaaS admin panels when vendors announce new AI features.
What the inventory unlocks
Once you have it, the rest of governance becomes manageable: risk assessments, EU AI Act classification, vendor reviews, targeted training, and fast, credible answers when customers ask “what AI do you use, and how do you control it?”
Official sources
- EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
- NIST AI Risk Management Framework: the framework and its supporting documents
- ISO/IEC 42001: the AI management system standard (paid)
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. This article is general information, not legal advice.