Stage 2 of 8 · 6 lessons · ~3 weeks

AI inventory: know what you run

You cannot govern what you cannot see. Find every AI system in an organisation, including shadow AI, describe and classify each one, assign a risk tier and a named owner, and keep models in a registry.

Start: What counts as an AI system

Lessons· one lesson for each topic, in this order

Do this

Invent a realistic sample company, such as a fintech, a hospital chain or an online retailer, with its teams.
List the AI it would plausibly use: built, bought and used by staff on their own.
Write three survey questions to find shadow AI that people would answer honestly.
Describe each system with purpose, users, affected people, data and vendor.
Assign an EU AI Act role and tier and an internal tier, with one line of reasoning each.
Name an accountable owner and a technical owner for each system.
Mark which systems need a model registry entry and what it would record.

Start with· follow one of these

GuideFree
NIST AI Risk Management Framework (AI RMF)
National Institute of Standards and Technology (NIST) · Intermediate
The Map function is the reasoning behind every inventory entry: context, purpose and who is affected
GuideFree
EU AI Act: regulatory framework for AI (European Commission)
European Commission · Beginner
Provider, deployer and the risk tiers, the two labels every inventory entry needs

Practise

MLflow Documentation
Register model versions with their runs, metrics and stages, then link them to inventory entries
Hugging Face Hub
Check model licences, base models and cards when you record third-party models

Keep handy

AI Act Service Desk and Single Information Platform
Article 6 and Annex III, which decide whether a system is high risk
AI Incident Database
Check what has gone wrong with similar systems before you set a tier

Also worth your time

Article 6: Classification rules for high-risk AI systems (opens in a new tab)Read
The exact rule for when a system is high risk, including the exceptions
ISO/IEC 42001: AI management systemsGo deeperPaid
How a certifiable AI management system expects inventories, roles and reviews to work

Before moving on: An AI inventory for a sample company of about 50 staff: at least eight systems including two shadow AI uses and two vendor features, each with purpose, owner, data, EU AI Act role and tier, internal tier and a written reason, plus a short note on how you found them.

Tauseef's advice

Start with the uncomfortable list: what staff actually use, not what was approved. An inventory that only contains official projects gives everyone false comfort.