If someone asks where AI is used in your company, a list of software licenses is a useful starting point. It is unlikely to tell the whole story.
One platform may support several activities with different data and different consequences. An employee may use an AI feature inside an existing product without buying a new tool. A pilot may be running outside the normal purchasing process.
I would build the inventory around business use cases, then connect each use case to the relevant systems and vendors.
Decide what one record represents
For a manageable first version, use one record per meaningful business activity. Link it to a system record when several activities share the same platform.
For example, “recruiting platform” is a system. “Summarizes interview notes for a recruiter” and “recommends candidates for a shortlist” are different uses. They should not disappear inside the same broad description.
NIST's Playbook explicitly addresses maintaining AI system inventories in GOVERN 1.6. The use-case structure below is my suggested business starting point, rather than a prescribed NIST template. Source: NIST Playbook, Govern.
Record information that helps someone act
A simple inventory can begin with these fields:
- Purpose: What task or decision does the AI support?
- People and owner: Who uses it, who may be affected and who maintains this record?
- System and provider: Which product, integration and known model or service are involved?
- Data and access: What information can it receive or retrieve, and what can it change?
- Output and action: Does it draft, recommend, publish, rank or execute?
- Status and review: Is it proposed, piloted, active, restricted or retired?
- Evidence: Where are the approvals, relevant terms, testing records and instructions?
- Last verified: When were the details checked, and by whom?
Include an “unknown” value. An inventory that honestly identifies missing information is more useful than one completed through guesses.
Keep sensitive details in controlled records and link to them appropriately. The inventory should not become an unrestricted copy of customer data, secrets or confidential system documentation.
Work through an example
Illustrative scenario: A staffing business lists one AI-enabled recruiting platform in its procurement records.
A walkthrough identifies three activities: rewriting job advertisements, summarizing interview notes and producing a suggested candidate shortlist.
For the advertisement tool, the team needs to know who checks factual claims and publishes the result. For interview summaries, it needs to understand the personal information involved and who can view the output. For the shortlist, it needs a clearer examination of how recommendations are used and how a recruiter can challenge them.
The inventory does not prove that any of these uses is appropriate. It makes the differences visible so the right review can take place.
Ask people to show you the work
Start with a small set of teams: Product, IT, Security, Operations, HR and Marketing, depending on your scope.
Instead of asking only “Do you use AI?”, ask people to show a recent task. Which tools did they open? What information did they enter? Was an AI feature enabled inside another service?
Compare those descriptions with purchasing records, product documentation, integrations and available administrative settings. Keep the difference between employee-reported use and verified system information clear.
This discovery should follow your organization's access and privacy rules. Do not turn it into unrestricted employee monitoring.
Give the inventory a maintenance route
A spreadsheet can be enough for the first version if access, ownership and updates are managed. Buying inventory software does not resolve those responsibilities.
I would connect updates to events the business already recognizes: a new purchase, a pilot request, a feature launch, a new data connection or a material vendor change. Also set a review date appropriate to the activity.
When a use ends, preserve the record and mark its status according to your retention requirements. Deleting it immediately may remove useful history.
A useful maintenance test is straightforward: after a product team connects its assistant to a new customer database, who updates the inventory, and how will anyone else learn that the use has changed?
Use the inventory to choose the next review
Look for missing owners, unclear data access, consequential actions and activities that have expanded beyond their approved scope. Bring those cases to the relevant decision-makers.
The inventory is a map of what you know. It becomes valuable when someone uses it to ask a better question and assign the next piece of work.
Download the free readiness check, or explore a scoped readiness assessment.
One response to “How to Build an AI Inventory Across Products, Employee Tools and Vendors”
[…] How to Build an AI Inventory Across Products, Employee Tools and Vendors […]