AI system inventory minimum fields
An AI inventory should support a decision. A product name and owner are not enough to understand use, impact or control.
Identify the system and use
Record the service, version, supplier, business purpose, users, affected people, deployment state and responsible owner.
Record data and decision effects
Describe input data, output, human review, downstream action, material limitations and foreseeable misuse.
Attach control evidence
Link testing, approval, monitoring, incidents, supplier evidence and change history. Give every unknown item an owner and review date.
Material reviewed for this guide
- Artificial Intelligence Risk Management Framework 1.0National Institute of Standards and Technology
- AI Risk Management Framework PlaybookNational Institute of Standards and Technology
This guide is general operational information, not legal advice. Check the official material and obtain appropriate advice for circumstances outside the stated scope.