Every framework starts here. ISO/IEC 42001 asks you to identify AI systems in scope. The NIST AI RMF's "Map" function begins with knowing where AI is used and by whom. The EU AI Act's deployer duties only work if you can name the systems you deploy. And Canada's Directive on Automated Decision-Making requires federal institutions to assess each system before use, which is impossible without a list.
An inventory is also the cheapest control you will ever build. It is a spreadsheet.
What counts as "AI" for the inventory
Be generous. Include:
- Products you built or fine-tuned: models, agents, scoring engines.
- Vendor tools with AI inside: applicant-tracking systems that rank candidates, CRM "next best action", fraud scoring, support chatbots, transcription, translation.
- General-purpose assistants staff use: ChatGPT, Claude, Gemini, Copilot, including free personal accounts used for work.
- Features switched on inside existing software: AI summaries in your helpdesk, automated email replies, generated images in your design tool.
- Automated decision rules that are not "machine learning" but still decide things about people; several laws (Quebec's Law 25, Colorado's SB 26-189) cover automated processing regardless of technique.
The minimum columns
For each entry record:
- Name and vendor (or "internal").
- Owner: one named person who answers for it.
- What it does, for whom: "ranks inbound applications for recruiters".
- Who is affected: customers, applicants, employees, the public.
- Data in / data out: does personal data enter? Does it decide or recommend?
- Where it runs: which countries' users and staff touch it.
- Role: are you builder, deployer, or both?
- Risk tier (filled in during the next lesson).
- Status: pilot, live, retired, and the date.
How to find shadow AI
Most inventories miss half the real usage on the first pass. Three cheap discovery methods:
- Ask: a two-question survey to every team ("Which AI tools did you use last month? What for?").
- Look at spend: expense reports and SaaS billing reveal subscriptions.
- Look at the network: your identity provider or DNS logs show which AI domains are in use.
Do not punish what you find. An inventory built on fear stays empty.
Keep it alive
- Add "register in the AI inventory" to your procurement and software-approval checklist.
- Review the list quarterly; retire entries no longer in use.
- Version it. Regulators and auditors ask "what did you know, and when".
Free tools count
A free chatbot account used to draft customer emails is still AI in your operations. It processes whatever your staff paste into it, which is usually personal data, and it produces content you send under your name. Free tools go in the inventory too.