AI inventory
governanceAI system inventory · AI register · AI use case inventory
The living record of which AI systems and agents are running in your company: for which process, over which data, with which permissions, who uses them and who answers for each one.
It's the census, and it's the first serious deliverable of any AI programme. Not a spreadsheet you fill in once — a record that updates when something goes into production and when something gets retired, with a named owner on every row. The EU AI Act has no article that literally says 'you shall keep an internal register'. But without the census you can't meet what it does require: registering high-risk systems in the EU database, applying transparency obligations to the systems they cover, or training the people who use them. That makes the inventory a de facto obligation — it isn't the rule, it's the only way to show you're meeting it. And before it's a compliance matter, it's an operational one: you can't measure, optimise or switch off what you never counted. (Note: in the US the same function shows up under agency and enterprise AI use-case inventories rather than the AI Act.)
How it differs from
- Agent registry
- An agent registry is technical and covers agents only: identity, endpoints, capabilities, permissions. An AI inventory covers every AI system in the company, including the ones you buy inside a SaaS, and adds the business and risk layer.
- AI control tower
- The inventory says what exists. The control tower operates what exists: monitors, prioritises, intervenes. The inventory is the map; the tower is the room.
Examples
- One row per system with: process served, data touched, model and vendor, risk tier, business owner, last review date.
- Cross-checking the inventory against AI vendor invoices to surface what's being paid for and never declared.
FAQ
- Is it mandatory under the EU AI Act?
- No article literally mandates an internal register. But obligations that do exist — high-risk system registration, transparency, AI literacy — are impossible to meet or evidence without having inventoried first. In practice, an organisation without one cannot demonstrate compliance.
- Where do you start if nothing exists?
- With the invoice and the browser, not the committee. AI vendors already being paid, extensions and tools people already use, and agents wired into critical systems. That gets you 80% of the map in a week.