The eight fields
- System name and vendor.
- Business purpose, in one sentence.
- Internal owner, by name.
- Which decisions it influences, if any.
- What data goes in, including personal data.
- Where that data is stored and processed.
- Whether a human reviews the output.
- Risk tier and date of last review.
What this means for you
Keep it in one place with a named owner per row, and review it quarterly. An inventory that is six months out of date is worse than none, because it is evidence that you stopped.
Where to start
Ask each department what AI tools they use, including the ones nobody approved. The unapproved ones are the reason the inventory exists.
When a questionnaire lands with a five-working-day turnaround, the inventory is the difference between a calm reply and a late, partial one.
Sources
PCPD AI Model Framework — pcpd.org.hk
ISO/IEC 42001:2023 — iso.org