Ask a governance lead how many AI systems their company runs and you usually get a pause. The honest answer, most of the time, is "we are not sure." That gap is the problem this article solves. You cannot assess risk, assign an owner, classify a system under the EU AI Act, or monitor for drift if you do not know the system exists. The inventory is where governance stops being a policy document and starts being an operational fact.
This is not a new lesson. Bank regulators have insisted on a complete model inventory for over a decade, and it remains one of the most common weak spots examiners cite. The difference in 2026 is scale and speed: generative tools, embedded vendor features, and autonomous agents are entering the enterprise faster than any manual process can track them.
Why the inventory is step one
Every downstream control assumes you already have a list. Almost no one does.
Start with the oldest precedent. The Federal Reserve and the OCC issued SR 11-7, their guidance on model risk management, in 2011. It requires banks to maintain a firm-wide inventory of all models, recording ownership, purpose, use, and limitations. When supervisors began applying that same discipline to machine learning and AI systems, inventory completeness became a recurring finding: examiners routinely discover models in production that never made it onto the register. The guidance was modernized in April 2026 as SR 26-2, but the inventory expectation is unchanged. The principle travels well beyond banking: you cannot govern what you cannot see.
The regulatory case is now broader. The EU AI Act works by risk tier. Its obligations attach differently to prohibited, high-risk, limited-risk, and minimal-risk systems, and the heaviest duties fall on high-risk uses listed in Annex III. You cannot classify a system you have not catalogued. Article 99 sets penalties up to 35 million euros or 7% of global turnover for prohibited practices, and up to 15 million euros or 3% for most other breaches. Transparency duties under Article 50 apply from 2 August 2026, and most high-risk obligations from 2 December 2027. Meeting any of those deadlines starts with knowing which of your systems are in scope.
Then there is shadow AI: tools adopted by employees or teams without any governance sign-off. A 2026 workplace survey found roughly two-thirds of office professionals had used AI tools at work they believed were not permitted, often pasting customer or financial data into public models. These systems make decisions and touch sensitive data, but they sit outside every control you have written. The inventory is how they surface.
What to put in it: the fields that matter
A register is only useful if each entry answers the questions a regulator, an auditor, or an incident responder will actually ask.
Resist the urge to capture everything. Capture the fields that drive a decision or an obligation. Each row below should exist for a reason you can defend. If a field never changes an assessment, a control, or a report, it is noise.
| Field | Why it matters |
|---|---|
| Owner (accountable person) | Every system needs one named human accountable for it. Ownership is the difference between a register and an orphan list. It is who you call when something breaks. |
| Purpose / use case | Describes what the system decides or produces and in what business context. Purpose drives risk tier: the same model can be low-risk for spam filtering and high-risk for hiring. |
| Data sources | Training and inference data determine privacy exposure, bias risk, and which regulations apply (GDPR, sector rules, data residency). |
| Model type | Classical ML, foundation model, fine-tuned model, or agent. Type shapes the testing, documentation, and monitoring you need. |
| Risk tier | A single classification (for example against EU AI Act tiers or an internal scale) that routes the system to the right controls and review cadence. |
| Lifecycle stage | Idea, development, validation, production, or retired. Stage decides which controls are due now and prevents "shadow production." |
| Third-party / vendor | Flags whether you built it or bought it. Vendor and embedded AI carry their own contractual, transparency, and due-diligence duties. |
| Deployment | Where it runs and who it touches: internal tool, customer-facing product, region, and integration points. |
| Monitoring status | Whether performance, drift, and outputs are actively watched, and by what. An unmonitored production model is a live risk. |
| Last review date | Turns the inventory from a snapshot into a living record. A stale review date is itself a finding. |
Two of these deserve emphasis. Owner is the field most often left blank, and it is the one auditors check first. Last review date is what separates a living inventory from a spreadsheet someone made in 2024 and never opened again.
Manual vs automated discovery
A spreadsheet gets you started. It does not keep you current.
Most programs begin with a manual census: send a form, interview teams, list what people admit to using. This is a reasonable first pass and it builds the schema you will need. But manual discovery has a structural flaw. It captures a moment, and AI adoption does not hold still. A new API key, a copilot switched on inside a SaaS suite, a fine-tuned model pushed by one engineer, an agent wired into a workflow: each one lands between census cycles. By the time you circulate next quarter's form, the register is already wrong.
Automated discovery closes that gap. A mature approach scans the places AI actually enters the organization and keeps watching them:
- Code repositories for model imports, API calls to AI providers, and prompt logic committed by developers.
- Cloud environments for deployed endpoints, managed ML services, and GPU workloads.
- SaaS and network traffic for embedded AI features and unsanctioned tools, which is how shadow AI gets surfaced rather than guessed at.
- Vendor and procurement records to catch AI that arrives inside products you bought rather than built.
The point of automation is not to replace human judgment. It is to keep the raw list continuously accurate so that governance effort goes into assessment and decisions, not into chasing what exists. The best inventories behave like a live register: automated discovery feeds them, humans classify and own the entries, and the record updates itself as systems change, move stage, or retire.
How to build it: a step-by-step
Seven steps take you from a blank page to a living inventory that feeds the rest of your program.
-
Scope and define what an "AI system" isWrite a one-paragraph definition and stick to it. Decide whether classical statistical models, rules engines, embedded vendor features, and agents are in scope. Ambiguity here is why systems fall through the cracks.
- Include: predictive models, generative tools, fine-tuned models, and autonomous agents.
- Decide explicitly on edge cases like simple automations and vendor copilots.
-
Pick your discovery methodsRun a manual census to seed the register, then layer automated scanning across code, cloud, and SaaS so it stays current. Treat the manual pass as a one-time bootstrap, not the ongoing method.
-
Set the schemaLock the fields from Section 02 as your standard. Make owner, purpose, risk tier, and lifecycle stage mandatory. A consistent schema is what lets you sort, filter, and report later.
-
Assign ownersEvery entry gets a named accountable person before it counts as complete. An entry without an owner is a task, not a record. This single rule prevents most orphaned systems.
-
Classify by riskApply a consistent risk tier to each system so effort follows exposure. Map to the EU AI Act tiers where relevant, and to an internal scale for everything else.
- Route each tier to the controls, documentation, and review cadence it deserves.
-
Connect it to the approval workflowMake the inventory the entry point for governance. New systems register before they go live; changes trigger re-review. The register becomes the front door, not an afterthought.
-
Keep it liveSet review cadences, wire in automated discovery, and track the last-review date on every entry. An inventory that is not maintained decays into fiction within a quarter.
Step five is where most of the value concentrates, so here is the classification most global teams anchor to. The EU AI Act sets four tiers, and your internal scale should map cleanly onto them:
| Tier | What it covers | Inventory implication |
|---|---|---|
| Unacceptable | Prohibited practices (for example social scoring, certain biometric uses) banned since 2 Feb 2025. | Flag and remove. Presence in the inventory is a compliance emergency. |
| High | Annex III uses such as hiring, credit, and essential services. Most duties apply from 2 Dec 2027. | Full documentation, testing, human oversight, and monitoring required. |
| Limited | Systems with transparency duties under Article 50 (for example chatbots, generated content) from 2 Aug 2026. | Track disclosure obligations and labelling. |
| Minimal | Most other AI, such as spam filters and recommendation features. | Log and monitor lightly; revisit if the use case changes. |
Common pitfalls
The failure modes are predictable, which means they are avoidable.
- The one-time spreadsheet. A census done once and never refreshed. It looks like coverage but describes a past that no longer exists.
- No owner. Entries with a system name and nothing else. When an incident hits, no one is accountable and no one can act.
- Missing agents and embedded AI. Autonomous agents and AI baked into vendor products are the fastest-growing category and the easiest to overlook. Gartner expects 40% of enterprise apps to embed agents by end-2026.
- No link to risk assessment. An inventory that sits in isolation is a catalogue, not a control. If registering a system does not trigger classification and review, it changes nothing.
The quiet failure. The most dangerous inventory is the one that looks complete. A tidy spreadsheet with confident entries can mask every shadow tool, every vendor copilot, and every agent that was never declared. Completeness you cannot verify is not completeness.
How the inventory feeds everything else
Get the register right and the rest of the program has something solid to stand on.
The inventory is not the goal. It is the data layer every other control reads from. Once each system is catalogued, owned, and tiered, the work that used to be guesswork becomes routine.
Key Takeaways
- The AI inventory is step one because every other control (risk assessment, regulatory classification, monitoring) assumes a complete list you almost certainly do not have.
- Inventory completeness has been a recurring supervisory finding under SR 11-7 for over a decade, and the same discipline now applies to AI and agents.
- Capture fields that drive a decision: owner, purpose, data sources, model type, risk tier, lifecycle stage, vendor status, deployment, monitoring, and last review.
- Manual census seeds the register; automated discovery across code, cloud, and SaaS keeps it current and surfaces shadow AI.
- Give every entry an owner, tie registration to your approval workflow, and treat "last review date" as a live control.
From policy to practice. Spreadsheets and ticket queues rarely keep up with how fast AI spreads across an enterprise. Dedicated AI governance platforms give governance teams one place to automatically discover every model and agent (including shadow AI), maintain a living inventory, and assess, monitor, and evidence it all against frameworks like the EU AI Act, NIST AI RMF, and ISO 42001.
Frequently asked questions
It is a live register of every AI system an organization uses: models, use cases, and increasingly autonomous agents. Each entry records who owns it, what it does, the data it uses, its risk tier, its lifecycle stage, and whether it is monitored. It is the foundational record the rest of a governance program reads from.
Because you cannot govern what you cannot see. Risk assessment, EU AI Act classification, monitoring, and audit all assume you already know which systems exist. Bank supervisors applying SR 11-7 have flagged incomplete model inventories as a top gap for years, and the same logic now applies across every sector using AI.
As a first step, yes. A manual census in a spreadsheet helps you define the schema and capture what people already know they use. The problem is drift: new models, embedded features, and agents appear between census cycles, so a static spreadsheet is out of date within a quarter. Move to automated discovery to keep it accurate.
Manual forms miss it by definition, because shadow AI is what people did not declare. Automated discovery across code repositories, cloud environments, SaaS applications, and network traffic surfaces unsanctioned tools and embedded vendor AI that no census would catch. A 2026 survey found roughly two-thirds of office workers had used AI they believed was against policy, so assume there is more than you think.
Yes, and increasingly they are the priority. Gartner expects 40% of enterprise applications to embed task-specific agents by the end of 2026. Agents act autonomously, hold permissions, and call other systems, so the inventory should extend to their identity, permissions, and observability, not just static models.
Treat it as continuous rather than periodic. Automated discovery should feed it in near real time, and every entry should carry a last-review date with a defined cadence based on risk tier. High-risk systems warrant more frequent review than minimal-risk ones. A stale review date is itself a finding an auditor will notice.
