Stage 2 · Lesson 6 of 6
Running the inventory as a governance register
From the policy side, the inventory is a register you design, collect and keep current. Design the fields first: system name, purpose, owner, vendor, data categories, people affected, decisions supported, EU and tier, internal tier, last review date and open risks.
Collect entries through a simple intake form that teams must complete before buying or launching AI, and through a one-off discovery exercise for what already exists. Review high-tier systems every quarter and others yearly. Report a short summary to leadership: how many systems, how many high risk, overdue reviews and open issues.
Common trapa perfect fifty-column spreadsheet that teams find too heavy to fill in, so they stop.
A question to check yourself, an AI practice session and 3 cheat sheet entries come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- GuideFreeNIST AI Risk Management Framework (AI RMF)
National Institute of Standards and Technology (NIST) · Intermediate
The Map function is the reasoning behind every inventory entry: context, purpose and who is affected
- GuideFreeEU AI Act: regulatory framework for AI (European Commission)
European Commission · Beginner
Provider, deployer and the risk tiers, the two labels every inventory entry needs