AI System Inventory and Classification

Objective

Maintain a complete, current, and classified inventory of all AI systems in development, deployment, and decommissioning to enable risk-based governance.

Applicability

AI types

LLM, Agentic AI, Traditional ML, Computer Vision, Generative AI

Deployment models

SaaS, Self-hosted, Hybrid, Edge

Lifecycle stages

Strategy & Planning, Operation & Monitoring

Risk domains

Governance

Regulatory regimes

EU AI Act, ISO 42001, NIST AI RMF, Banking, Healthcare

Company size

SMB, MidMarket, Enterprise

Rationale

Without a comprehensive inventory, organizations cannot apply risk-based controls, comply with regulations such as the EU AI Act (which requires classification), or detect Shadow AI. The inventory is the foundation for every other AI control.

Control narrative

The organization maintains an authoritative inventory of all AI systems across the lifecycle. Each entry captures owner, business purpose, AI type, data sensitivity, autonomy level, third-party dependencies, deployment environment, regulatory classification (e.g., EU AI Act risk tier), and lifecycle stage. The inventory is reviewed quarterly and updated upon any material change. Intake of new AI systems requires registration prior to development or procurement. The inventory is governed by a designated owner (typically the AI Governance lead or CISO) and integrated with related registers (asset, application, vendor).

Test of Design

Procedures

1. Obtain the AI System Inventory and confirm it is centrally managed and version-controlled.
2. Confirm the inventory schema includes: owner, business purpose, AI type, data sensitivity, autonomy level, third-party dependencies, deployment, regulatory classification, lifecycle stage.
3. Confirm a documented intake process exists requiring registration prior to development or procurement.
4. Confirm review frequency is documented (minimum quarterly) with an assigned owner.

Inquiries

• Who owns the AI inventory?
• How are new AI systems discovered and registered?
• How are Shadow AI / unauthorized AI systems identified?
• What is the integration with the broader IT asset and application registers?

Inspections

• AI Inventory policy or standard.
• Inventory schema or data dictionary.
• Intake / registration workflow documentation.
• Sample of completed registration submissions.

Test of Operating Effectiveness

Procedures

1. For the audit period, obtain the population of net-new AI systems registered.
2. For a sample, confirm registration occurred prior to production deployment by inspecting workflow timestamps and change records.
3. For each sampled system, confirm all required fields are populated and accurate by inspecting source artifacts (architecture diagrams, vendor contracts, DPIAs).
4. Independently corroborate inventory completeness by sampling 5–10 known AI use cases (from interviews, network logs, SaaS spend, code repos) and confirming they appear in the inventory.
5. For systems flagged as 'high-risk' under EU AI Act or equivalent, confirm classification rationale is documented.

Sample-size guidance

Reperformance

• For 3 sampled systems, independently re-derive the EU AI Act risk classification using the published criteria and compare to management's classification.

Evidence requirements

Required

• AI Inventory export (current state) CSV/Excel · At fieldwork
• AI Inventory policy PDF/Word · At fieldwork
• Registration workflow / ticket samples Screenshots or system export · Per sample
• EU AI Act classification rationale (for high-risk systems) Documented assessment · Per high-risk system

Supporting

• Inventory change logs System log export · Annual
• Quarterly review meeting minutes Meeting notes · Per quarter in scope

Retention: 7 years for regulated environments; 3 years otherwise

Framework mappings

Related controls

• AI-CTRL-002

  Training Data Provenance and Lineage

• AI-CTRL-004

  Third-Party AI Vendor Due Diligence

• AI-CTRL-020

  Shadow AI Detection

References

• ISO/IEC 42001:2023 — AI management systems
• NIST AI Risk Management Framework 1.0
• EU AI Act — Regulation (EU) 2024/1689