AI System Inventory and Risk-Tier Register for Software Companies
Most companies cannot answer a simple question: where are we using AI? Build an inventory and risk register that discovers AI use (features in the product, AI tools staff sign into, AI APIs in code and cloud bills), records an owner and purpose for each, assigns a risk tier from a clear rubric mapped to the NIST AI RMF and the EU AI Act, and schedules reviews. Designed for software houses that sell to clients abroad.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
7 to ship
3 optional extrasSuggested stack
What you should ship
- A data model for AI systems: purpose, owner, users affected, data used, model and vendor, human oversight, risk tier, review date
- Discovery helpers: scan code repositories for AI SDK imports and API calls, parse cloud bill exports for AI services, and import an SSO app list to find AI tools staff use
- A risk-tier rubric with explained questions, mapped to NIST AI RMF functions and to EU AI Act categories, producing a tier and the reasons
- Workflows: register, review, approve and retire an AI system, with reminders and an audit history
- Exports for clients and auditors: a one-page summary per system and a full register as CSV
- A pilot with a real software house or university IT office (with permission), or a realistic fictional company of at least 25 AI systems
- A report on how many AI systems discovery found that nobody had listed by hand
If you have time left
- Mapping register fields to ISO/IEC 42001 controls
- Vendor questionnaires sent to AI suppliers with tracked answers
- Slack or Teams reminders for owners
The problem: nobody knows where the AI is
In a typical software company, AI shows up everywhere at once: a chatbot in the product, an LLM call in a backend job, a transcription tool in sales, coding assistants on every laptop, and a dozen browser-based AI tools that people signed up for with a work email. When a client asks "list the AI systems that touch our data", the answer is a scramble.
The NIST AI Risk Management Framework lists keeping an inventory of AI systems as a governance practice (GOVERN 1.6). ISO/IEC 42001, the AI management system standard published in 2023, also starts from knowing what you have. For Pakistani, Indian and Bangladeshi software houses with clients in the EU, the EU AI Act adds another reason: you cannot work out your obligations until you know your systems.
What already exists and the gap
- Enterprise AI governance platforms such as Credo AI, OneTrust's AI governance module and IBM watsonx.governance offer inventories and risk workflows for large organisations.
- Spreadsheets are what most smaller companies actually use.
- SaaS management tools discover apps from SSO and expenses, without AI risk logic.
The gap is a lightweight, self-hostable register for small and mid-sized software companies that discovers AI use automatically and applies a clear, explainable risk rubric.
Inspiration
Security teams learned long ago that you cannot protect assets you have not listed. This project brings the asset inventory habit to AI, using public frameworks rather than invented scoring.
What you build
- A register with a clean data model and workflows.
- Discovery from code, bills and sign-in data.
- A rubric that explains every tier it assigns.
- Exports that a client or auditor can read.
The technically interesting part
- Discovery without spying. Scan code and billing data, and use SSO app lists, but do not monitor individual browsing. Write down where the line is and why.
- An explainable rubric. Each question must have a reason and a reference. A tier with no reasons is useless in an audit.
- Change over time. Systems change model, vendor or purpose. Track versions and trigger re-review on meaningful changes.
How you will evaluate it
- Number of AI systems found by discovery versus a manual list.
- Agreement between your rubric's tiers and tiers given by two independent reviewers on the same systems.
- Time for an owner to register a system, measured in a short usability test.
Path to a product
Client due diligence questions about AI are becoming routine for outsourcing companies. A register priced per company, or offered alongside AI governance consulting, is a credible business, especially for firms that export software services.
Scope warning
This is not legal advice, and the tool should say so. Keep the rubric small and well referenced. If you pilot with a real company, get written permission and avoid storing sensitive details.
Learn what you need on Sefism
- AI governance roadmap: inventories, risk tiers, the NIST AI RMF and the EU AI Act in practice.
- AI governance cheat sheet: the frameworks and their key terms in brief.
- NIST AI Risk Management Framework: the functions your rubric maps to.
- AI security roadmap: the security risks that feed into each tier.
- Next.js documentation: building the web app.
- PostgreSQL documentation: the database behind the register.
- What does an AI governance job involve?: the job this tool supports, day to day.
Get help with this idea
The risk is a form-filling app nobody keeps up to date. Tauseef can help you design discovery, keep the rubric explainable and find a realistic pilot. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.