Governance · AI governance and assurance · 01
AI use inventory and classification
An AI use inventory and classification establishes where AI systems are actually used across the organization, by whom, for what decisions, with what data, through which vendors, and how consequential each use is. It is needed when leadership cannot answer a customer, insurer or regulator who asks where AI is in use, when staff have adopted AI tools without any record, when an ISO/IEC 42001 or NIST AI RMF program needs its starting point, or when a contract restricts how AI may touch client data. The inventory produces a complete register of AI uses with owners and data flows, a classification of each by consequence and regulatory exposure, the uses that require immediate attention, and the baseline every other governance activity builds on.
Scope
What the review covers.
- Discovery of AI use across business units, tools, vendors and embedded features
- Data flows: what data enters each system and where outputs go
- Decision impact: what each use decides or influences, and for whom
- Classification by consequence, regulatory exposure and contractual constraint
- Ownership and accountability per use
- Register design and maintenance
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| AI use register | Every use with owner, data, purpose and vendor |
| Classification | Consequence and exposure rating per use, with reasoning |
| Priority list | Uses needing immediate governance attention |
| Maintenance procedure | How new uses enter the register |
Prerequisites
What we need from you.
- Access to business unit leads and IT for discovery
- Vendor and subscription records to identify AI features in existing tools
- The contracts and regulations that constrain AI use, if known
Related
Where this sits.
- AI governance and assurance Service
- Governance Hub
- ISO/IEC 42001 readiness Also
- NIST AI RMF alignment Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Does this include AI features inside tools we already own?
Yes. Embedded AI in office, CRM, security and development tools is usually the largest and least visible category.
How do you find unsanctioned use?
Through interviews, subscription and expense records, network and identity logs, and a short staff survey. The combination finds what any one source misses.
Is the register itself a compliance requirement?
ISO/IEC 42001 and the NIST AI RMF both depend on knowing what AI is in use. Customers and regulators increasingly ask for it directly.