The U.S. National Institute of Standards and Technology’s AI Risk Management Framework, published in January 2023 as a voluntary guidance, states that organizations should put “mechanisms in place to inventory AI systems.” NIST’s companion Playbook suggests organizations write policies defining how inventories are created and maintained.

The inventory sits inside the Govern function because it is the foundation for everything else. You cannot map context, measure performance or manage risk for a system nobody has recorded.

 

What governments learned the hard way

Governments have run AI inventories at scale, and their experience is instructive.

Under Office of Management and Budget Memorandum M-25-21, U.S. federal agencies must inventory their AI use cases at least annually, submit the inventory to OMB and publish a public version, as the Occupational Safety and Health Review Commission explains on its AI page. The Federal Reserve Board and the Department of Justice both publish inventories citing the same memo and the AI in Government Act of 2020. The Equal Employment Opportunity Commission, in its compliance plan, describes keeping a “centralized AI Use-Case Tracker” to log and monitor its AI use.

The Government Accountability Office reviewed the 23 civilian agencies covered by the Chief Financial Officers Act. In its December 2023 report, it found that 20 of them reported about 1,200 current and planned use cases. Only five agencies gave comprehensive information for every use case, while the other 15 had incomplete or inaccurate data. Global Government Forum, summarising the report, noted that GAO made 35 recommendations to 19 agencies. Some inventories included technology that was later determined not to be AI, and eight use cases were duplicated across four agencies.

GAO’s warning was that poor inventories mean AI management “will be hindered by incomplete and inaccurate data.” Nextgov’s coverage added that about 200 of those 1,200 use cases were actually in use, with most still in planning. That is the kind of information an inventory exists to provide.

Independent researchers saw the same pattern, FedScoop reported that Stanford’s RegLab published an implementation assessment in December 2022 documenting patchy compliance with the original inventory order. Christie Lawrence, a co-author and RegLab affiliate, stressed the need for “consistent and accurate AI use case inventories.” Lynne Parker, a former White House AI official who worked on the original effort, told FedScoop that the point of collecting use cases is “to have them in one spot” so they can be analysed and learned from.

 

The people problem

Inventories matter beyond government because staff adopt AI faster than policy catches up. The 2025 global study Trust, Attitudes and Use of Artificial Intelligence, led by Professor Nicole Gillespie and Dr. Steve Lockey at Melbourne Business School, University of Melbourne, surveyed more than 48,000 people in 47 countries between November 2024 and January 2025.

Its findings on workplace governance were that:

  • 66% of employees rely on AI output without evaluating its accuracy, and 56% report making mistakes in their work because of AI.
  • 57% say they hide their use of AI and present AI-generated work as their own.
  • Only 47% have received AI training, and just 40% say their workplace has a policy or guidance on generative AI.

Governance, in the researchers’ framing, is trailing behind usage. If staff conceal AI use, no amount of policy writing will reveal where AI is accessing your data and decisions. Gillespie said that trust in AI and its safe, secure use is “central to sustained acceptance and adoption.”

Read also: Shadow AI is outpacing healthcare email security

 

Regulation is moving toward the same place

California’s CCPA regulations apply to automated decision-making technology used for significant decisions about people, such as hiring, housing, credit, education and healthcare. They define ADMT as technology that processes personal information and uses computation to replace or substantially replace human decision-making. Before using it, businesses must give a pre-use notice and either let people opt out or offer an appeal to a human reviewer. The notice explains the system’s purpose, the person’s right to opt out or appeal, their right to access information about the system, and how it processes personal information.

The human involvement has to be real. A reviewer must know how to interpret the system’s output, review it alongside other relevant information, and have authority to make or change the decision.

Colorado is heading the same way, Governor Polis signed SB 26-189, which repeals and replaces the 2024 Colorado AI Act. The new law shifts from proactive risk-management obligations to consumer transparency and rights. Deployers must provide disclosures before use, explain adverse outcomes within 30 days, and offer a path to meaningful human review where commercially reasonable.

 

What a good AI inventory contains

Drawing on the federal guidance and NIST’s framework, a useful inventory records at least:

  1. What the system is and does: Document its purpose, business function and the decisions it informs or makes.
  2. Who owns it: Name an accountable person, not a committee.
  3. What data it uses: Note whether personal, sensitive or confidential information is involved.
  4. Whether it was built or bought: Include third-party tools and AI features embedded in existing software.
  5. Its risk level: Flag systems affecting people’s rights, safety, employment or access to services. U.S. federal guidance requires agencies to identify such use cases individually.
  6. Its lifecycle stage: GAO found that inconsistent lifecycle data was one of the most common inventory failures.
  7. Who oversees it, and how: Record the trained human reviewer and the escalation path.

Read also: What AI in healthcare actually looks like in 2026

 

FAQs

What is an AI inventory?

It is a central record of every AI system an organization uses, covering what each one does, who owns it, and what data it touches.

 

How often should an inventory be updated?

It should be reviewed on a regular schedule, at least annually, and whenever a new AI tool is adopted or an existing one changes significantly.

 

Does an inventory only cover AI that an organization builds itself?

No, it should also include third-party tools and AI features embedded in software the organization already uses.

 

What is “shadow AI”?

It refers to AI tools used by employees without the knowledge or approval of their organization’s IT or governance teams.