AI system inventory minimum fields

Are these fields mandatory?

This is an operational starting point informed by voluntary NIST AI RMF 1.0. It is not a statutory minimum or certification requirement.

The Playbook offers suggestions, not a checklist to complete in full. Tailor the record to the system and its real decision effects.

Worked example. One useful system record

Fictional example. System AI-014 drafts support replies for staff approval. Record that use, not merely the supplier’s product name.

Its input is a restricted test set. Its output is a draft. The lifecycle state is pilot, with automatic sending prohibited.

The support lead owns the use. Procurement owns missing retention evidence. Security owns access testing. Those are distinct responsibilities.

A proposal to send replies automatically triggers change review. The existing approval does not silently cover the new use.

Keep “unknown” distinct from “not applicable”. Assign an evidence request rather than guessing a supplier fact.

Identify the system and use

Record the service, version, supplier, business purpose, users, affected people, deployment state and responsible owner.

Record data and decision effects

Describe input data, output, human review, downstream action, material limitations and foreseeable misuse.

Attach control evidence

Link testing, approval, monitoring, incidents, supplier evidence and change history. Give every unknown item an owner and review date.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Record a stable reference, service, model or version and supplier.
• Describe purpose, users, affected people and deployment locations.
• Record lifecycle state, accountable owner and approval reference.
• Map inputs, outputs, integrations and downstream actions.
• Document human review, prohibited uses and known limitations.
• Link tests, monitoring, incidents, supplier evidence and change history.
• Name action owners and material change-review triggers.

• Fictional US AI inventory PDF. Inspect one system record and its evidence gaps. It is not NIST certification.