What is an AI system inventory?
An AI system inventory is a maintained record of the AI tools, models and enabled features an organization uses. It connects each system to its purpose, supplier, information, owner, status, review date and supporting evidence.
You may also hear it called an AI register or AI systems register. Start with one record for each identifiable system. Describe different uses separately when their owners, information access or review needs differ.
A list of software names alone cannot explain how AI is used. The inventory adds that context so reviewers can follow up on unknowns and changes.
Why keep an AI system inventory?
- Know what you useSee AI systems in use across teams and suppliers.
- Manage riskUnderstand data access, purpose and potential impacts.
- Assign accountabilityEnsure clear ownership and review for each system.
- Support decisionsInform procurement, security, privacy and business decisions.
- Demonstrate good practiceShow structured management through clear records and evidence.
What should an AI system inventory include?
Use these fields as a starting point, then adapt them to your organization. The editor collects the core details. Use review notes or linked evidence for additional context, versions, outputs and change history.
| Field | What to record | Why it helps |
|---|---|---|
| System name | The name your organization uses for the system or enabled feature. | Required |
| Provider | The company, internal team or other party that provides it. | Required |
| Where used and users | The teams, roles, business units and US locations that use it. | Recommended |
| Purpose and output | The task it supports and what it produces, recommends or influences. | Required |
| Information used | Categories of information and connected systems. Do not paste confidential contents or access credentials. | Required |
| Responsible owner | The person or role accountable for the use and the record. | Required |
| Record status | Whether this record is in progress, open, complete, on hold or unknown. This is not an approval status. | Starts in progress |
| Review month | The month when your organization plans to review the record. | Recommended |
| Evidence notes | Links or references to evaluations, contracts, policies and approvals. | Recommended |
| Review notes | Unknowns, restrictions, changes and follow-up work. | Recommended |
What counts as an AI system?
For this inventory, include tools that use machine learning, language models or other AI techniques to generate, predict, classify, recommend or decide.
Check supplier tools, embedded features, model APIs, AI agents and systems you build. Not every automation uses AI. Confirm the capability with its owner or supplier when you are unsure.
Record connected AI features even when staff access them through another application. This is a practical inventory scope, not a legal definition or applicability test.
How do you find AI use across your organization?
- Speak with team leaders and process owners.
- Explore software settings and connected services.
- Review procurement records and contracts.
- Audit data connectors and integrations.
- Check browser extensions and plug-ins.
- Ask staff about workarounds and shadow tools.
- Check trials, AI-enabled automations and embedded features.
- Give staff a clear way to report an unrecorded tool.
How do you build the inventory?
- 1Find systems
List tools, models and features you use or plan to use.
- 2Add context
Record purpose, information, users, outputs and risks.
- 3Assign ownership
Name an accountable owner and set access arrangements.
- 4Review unknowns
Fill gaps, add evidence and confirm the next review date.
- 5Maintain the record
Keep it current, update changes and archive retired systems.
Who should own and maintain it?
| Role | Responsibilities |
|---|---|
| Business owner | Owns the tool for its purpose and ensures it delivers business value responsibly. |
| AI governance | Maintains the inventory, sets standards and oversees reviews. |
| Privacy | Reviews data access, purpose and privacy controls. |
| Security | Assesses security posture and technical controls. |
| Procurement | Manages supplier information, contracts and due diligence. |
| Risk and compliance | Provides second checks and escalates findings. |
When should a record be reviewed?
- When the tool gains new data access.
- When a material feature or model changes.
- When the supplier or hosting location changes.
- When an incident or issue is identified.
- When the purpose or user group changes.
- On the planned review date you set.
What does a completed record look like?
Fictional example. Northstar Software is a placeholder supplier. These details illustrate the record structure, not a supplier assessment, approval or claim about a real deployment. Scroll across to see every field.
| Tool name | Supplier | Intended use | Information accessed | Users | Owner | Status | Next review | Evidence |
|---|---|---|---|---|---|---|---|---|
| Contract review assistant | Northstar Software | Review and summarize customer contracts | Contract text and attachments | Legal and procurement | Legal Operations Manager | In progress | December 4, 2026 | Supplier contract and evaluation report |
Common mistakes to avoid
- Recording only standalone chatbots and missing embedded features.
- Using vague or missing owners and unclear accountability.
- Omitting information accessed or data flows.
- Relying on unsupported claims instead of evidence.
- Leaving records stale and not reviewing them after change.
How teams can use this record
- Procurement
- Assess vendors and negotiate appropriate terms.
- Security
- Identify risks and set technical controls.
- Privacy
- Map data use and support privacy reviews.
- Audit
- Provide evidence of oversight and reviews.
- Business continuity
- Maintain knowledge of critical AI dependencies.
How does this relate to the NIST AI RMF?
The NIST AI Risk Management Framework is voluntary. In version 1.0, Govern 1.6 covers inventory mechanisms and resourcing that work according to organizational risk priorities.
This tool helps organize the inventory record. It does not assess risk, complete the framework or provide NIST certification.
NIST is revising AI RMF 1.0. This guide references the published 1.0 material, not a future revision.
| Source | How it helps |
|---|---|
| NIST AI RMF 1.0 | Provides the framework and its current publication status. |
| AI RMF Core, Govern 1.6 | Describes AI inventory mechanisms and resourcing based on organizational risk priorities. |
| NIST AI RMF Playbook | Offers voluntary practical suggestions for applying the framework. |
Common searches
These are recognized names and task phrases for this tool. Search uses them locally in this browser.
- AI inventory
- AI register
- artificial intelligence inventory
- AI system inventory
- AI systems register
Show 31 more search terms
- AI tool register
- AI application register
- AI application inventory
- LLM inventory
- model inventory
- AI model register
- generative AI inventory
- shadow AI inventory
- enterprise AI inventory
- AI inventory template
- AI system register template
- AI inventory spreadsheet
- AI inventory example
- AI tool register example
- AI inventory checklist
- AI inventory best practices
- how to create an AI inventory
- how to track AI tools in use
- what is an AI system
- NIST AI RMF inventory
- NIST AI RMF Govern 1.6
- record AI systems
- keep track of AI tools
- AI governance
- artificial intelligence governance
- record
- register
- Record title
- Owner
- Status
- Customer-defined review month
Common questions
What counts as an AI system?
Include any tool, model or enabled feature that uses machine learning, language models or other AI techniques to generate, predict, classify, recommend or decide.
What if I do not know every answer?
Record what you know, mark the gap clearly and assign someone to confirm it. An explicit unknown is more useful than a guessed answer.
Who should own the record?
Choose the person or role accountable for the business use. Privacy, security, procurement and AI governance teams can provide review.
How often should it be reviewed?
Set a schedule that matches your own risk and change process. Review sooner after material changes, incidents or new information access.
Is an AI inventory the same as an AI use-case register?
No. An inventory identifies systems and how they are used. A use-case register describes individual proposed or existing uses. One system may support several use cases. Keep the records linked so each use has a clear owner and purpose.
Should I include AI features inside software we already use?
Yes. Include enabled AI features in existing software, not only standalone chatbots. Record the host application, feature name, supplier and teams using it. Note which information the feature can access.
Can I use a spreadsheet for an AI inventory?
Yes. The format matters less than clear fields, accountable owners and regular updates. The field guide and fictional example below show a useful starting structure. This page provides a guided editor and a JSON backup, not a downloadable spreadsheet template.
How do I know my answers have been saved?
Check the account save message above the form. Only a confirmed save means the latest answers reached your account. If saving fails, keep the tab open. Add your record and download a backup before leaving. Backups include completed records, not an unfinished draft or original evidence files.
Does an inventory approve a tool?
No. The inventory records facts and evidence. Your organization must make and document approval decisions separately.
What this tool does not decide
This tool captures and records information to help you manage AI risks and due diligence.
It does not give legal advice, calculate applicability, perform risk assessments, approve tools or certify compliance.
Use it alongside your organization’s policies, assessments and decision-making processes.