A practical AI inventory starter

A practical starting point for organisations where AI is already in use and no policy exists yet, which is most of them.

Why an inventory rather than a policy.

A policy written before anybody knows what is being used describes an imagined situation and is enforced by asking people to read it. An inventory describes the actual one, and it usually changes what the policy needs to say. It also tends to surface the two or three uses that genuinely need attention, rather than treating every use as equally risky.

What the document covers.

A short set of fields to record per use: what it is, who owns it, what data it sees, whether a person or a system acts on the output, and when it was last reviewed. A three-grade classification based on effect rather than on tool. The controls that suit each grade. A registration route designed to be faster than working around it. And the questions worth adding to procurement, which is where most new capability actually enters an organisation.

What it deliberately avoids.

Model comparisons, vendor recommendations and anything that will be out of date in a quarter. The controls described here work regardless of which tools are in use, which is the point of writing them that way.