Stage 2 of 8 · 6 lessons · ~3 weeks

AI inventory: know what you run

You cannot govern what you cannot see. Design an AI register, run discovery for shadow AI, classify each system, assign a risk tier and a named owner, and set review cycles that teams will actually follow.

Start: What counts as an AI system

Lessons· one lesson for each topic, in this order

Do this

Invent a realistic sample company, such as a fintech, a hospital chain or an online retailer, with its teams.
List the AI it would plausibly use: built, bought and used by staff on their own.
Write three survey questions to find shadow AI that people would answer honestly.
Describe each system with purpose, users, affected people, data and vendor.
Assign an EU AI Act role and tier and an internal tier, with one line of reasoning each.
Name an accountable owner and a technical owner for each system.
Mark which systems need a model registry entry and what it would record.

Start with· follow one of these

GuideFree
NIST AI Risk Management Framework (AI RMF)
National Institute of Standards and Technology (NIST) · Intermediate
The Map function is the reasoning behind every inventory entry: context, purpose and who is affected
GuideFree
EU AI Act: regulatory framework for AI (European Commission)
European Commission · Beginner
Provider, deployer and the risk tiers, the two labels every inventory entry needs

Practise

Notion
Build the register as a database with an intake form and review dates
draw.io (diagrams.net)
Draw how one high-risk system takes data, makes decisions and reaches people

Keep handy

AI Act Service Desk and Single Information Platform
Article 6 and Annex III, which decide whether a system is high risk
AI Incident Database
Check what has gone wrong with similar systems before you set a tier

Also worth your time

Article 6: Classification rules for high-risk AI systems (opens in a new tab)Read
The exact rule for when a system is high risk, including the exceptions
ISO/IEC 42001: AI management systemsGo deeperPaid
How a certifiable AI management system expects inventories, roles and reviews to work

Before moving on: An AI inventory for a sample company of about 50 staff: at least eight systems including two shadow AI uses and two vendor features, each with purpose, owner, data, EU AI Act role and tier, internal tier and a written reason, plus a short note on how you found them.

Tauseef's advice

Make the intake form short enough that a busy manager fills it in. You can always ask follow-up questions for high-risk systems; you cannot govern systems nobody declared.