Free template
Know what AI you have, and how much it matters
A spreadsheet inventory of every AI system in use, and a five-question rule that sorts each one into a risk tier. Most uses land in the lowest tier, which is the point: governance goes where the consequences are.
The first list is always longer than the board expects
Many of the surprises are not tools anyone chose. They arrive inside software the business already pays for: a CRM release note announces AI features "now available to all users", switched on by default and processing customer data. Nobody decided to use AI in the sales process. It happened anyway.
The inventory is the single most useful governance record a business can keep. It is also where ISO/IEC 42001 and the EU AI Act both start: you cannot govern what you have not listed.
What to record for each system
One row per use, not per product. A tool used in three ways has three rows.
Name and route
The product, and how it is reached. A personal app, a business workspace, a feature inside another product, or an API.
Owner
The named person accountable for this use. Systems you build need a business owner and an engineering owner.
Use
What it is used for, by whom, in which process.
Data
The classes of information that go in, and whether any is personal or special-category data.
Authority
Whether it informs decisions about people, talks to customers unsupervised, or can act in other systems.
Tier, terms and evidence
The risk tier, the contract and data terms, whether an impact assessment is done, where the logs are, and the review date.
Finding what is really in use
Asking is not enough on its own. Work through:
- Expense claims and card statements. Personal subscriptions show up here.
- Sign-in logs. Which services people reach with their work accounts.
- Browser extensions on managed devices.
- Procurement records and renewals.
- Vendors' release notes for your CRM, ERP, HR, finance, customer service and office software.
- Each team, with an amnesty. Still the most productive source, if honest answers carry no penalty.
Keep it in a spreadsheet the owner will actually maintain. Review it every quarter, and whenever a major platform announces AI features.
Govern the use, not the technology
The same assistant can be low risk drafting a newsletter and high risk screening applicants. Five questions decide the tier, and a use moves up a tier when any one answer moves up.
- What information goes in? Public or internal, confidential, personal, or special-category.
- What is the effect on people? None, indirect, or a direct decision about someone's job, money, access, health or rights.
- How much autonomy? A person reads every output; outputs are used without review; or it acts on its own.
- How reversible, and how large? A draft that can be corrected, or a message already sent to ten thousand customers.
- Is it in a regulated class? A high-risk use under the EU AI Act, an automated decision under data protection law, or a use a sector regulator governs.
| Tier | Typical uses | What it needs |
|---|---|---|
| 1 Low | Drafting, summarising, research, coding with review | The policy and the approved-tools list |
| 2 Medium | Summarising complaints, customer replies a person sends, AI features in the CRM | An inventory entry, a named owner, a short assessment, the terms on file, a review date |
| 3 High | Screening applicants, credit or pricing decisions, unattended customer chat, agents that can act | A full impact assessment, defined human oversight, testing before use, monitoring after, and the owner's signed acceptance of the risk |
| Stop | Prohibited practices, and anything the business has decided not to do | Not assessed. Not done. |
The start of an inventory for a business of two hundred
| System and route | Owner | Use | Authority | Tier |
|---|---|---|---|---|
| Assistant, business workspace | Operations director | Drafting, summarising, research | None; a person reviews all output | 1 |
| Assistant, business workspace | Head of service | Summarising complaints, drafting replies a person sends | None; a person sends every reply | 2 |
| AI features in CRM, switched on by the vendor | Sales director | Call summaries, lead scoring, draft emails | Lead scores influence follow-up | 2 |
| Website chatbot | Head of service | Answering customer questions unsupervised | Speaks for the business | 3 |
| Applicant screening in the HR platform | HR director | Ranking applications | Informs shortlisting | 3 |
| Invoice-matching agent, built in-house | Finance controller and engineering lead | Matching invoices to orders | Proposes payments; a person approves | 3 |
Three lessons usually come out of a first inventory. Most entries are tier 1 or 2. The tier 3 entries are few, and often include something nobody consciously chose. And systems the business built itself need two owners.
Using the template
Who should own the inventory?
The person accountable for AI governance: usually an existing director or senior manager, not a committee. They also approve amber uses and report to the board.
Do we need to record every chatbot conversation?
No. The inventory lists systems and uses, not individual conversations. Logs for high-risk uses are recorded in the evidence column.
How does this relate to ISO 42001?
The inventory, the owners and the risk tiers are the core of an ISO/IEC 42001 management system. Keeping them is most of what an auditor or a customer will ask to see.
From a list to a governance system
GOVERN chapter 9 goes further: the owner's role and the board's, finding shadow AI, and keeping governance in proportion. Or we can build the inventory with you.