What it means
- A single, up-to-date list of every AI system the company builds, buys or uses, including AI features switched on inside SaaS tools.
- Each entry records: purpose, owner, users affected, model and vendor, data used, dependencies, risk tier, where it runs, go-live date, and open issues or grievances.
- For platforms, it also flags features that create or spread synthetic content (deepfakes, AI images, voice clones), since these carry their own legal duties.
Why it matters
- You cannot govern what you cannot see. Every other control (risk tiering, testing, monitoring, audit) starts from this list.
- RBI FREE-AI expects an inventory updated at least half-yearly and ready for supervisors.
- The 2026 IT Rules amendment requires platforms to know which features generate synthetic content.
Checklist
- Define what counts as an AI system for the inventory (link to the definition in SC-AI-001 AI governance policy approved by the board or top management).
- Run a discovery sweep: survey business heads, check procurement and expense records for AI tools, scan SaaS admin consoles for AI features, check cloud accounts for model endpoints.
- Create the register (GRC tool, CMDB extension or controlled spreadsheet) with mandatory fields listed above.
- Assign each entry a risk tier via SC-AI-004 AI risk classification and use-case tiering.
- Flag synthetic content features separately.
- Make intake mandatory: no new AI use goes live until it is in the register.
- Reconcile at least every six months and after any major change; record the review.
Evidence examples
- Exported AI inventory with owner, tier and last-reviewed date for each entry.
- Half-yearly reconciliation sign-off by the AI risk owner.
- Procurement or intake form that requires an inventory ID before purchase approval.
- Discovery evidence, such as a SaaS admin report showing AI features enabled or disabled.
Common pitfalls
- Listing only in-house models and missing vendor AI and embedded SaaS features.
- A one-time exercise that is never refreshed.
- Missing owner or risk tier fields, so the list cannot drive other controls.
- Keeping the AI list separate from the IT asset register with no link between them.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- BindingNYC Local Law 144 (AEDT)
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 4.3 Scope of the AI management system
- A.4.2 Resource documentation
- A.4.3 Data resources
- A.4.4 Tooling resources
- A.4.5 System and computing resources
ISO/IEC 27001
- A.5.9 Inventory of information and other associated assets
- A.5.12 Classification of information
SOC 2
- CC6.1
Key takeaways
- The inventory is the foundation; build it before anything else.
- Strong reuse from ISO 27001: extend your existing asset inventory (A.5.9) with AI-specific fields rather than starting a new register.
- Include shadow and embedded AI, and refresh at least half-yearly.