DECISION NOTE · AI GOVERNANCE · OCTOBER 2026

A practical enterprise AI inventory: what to record, who owns it, and why

An AI inventory becomes useful when it can answer a management question: where is AI changing work, information, decisions or action—and what must the organization know to govern that change?

A spreadsheet containing product names and licence counts is not an enterprise AI inventory. It cannot tell management which workflows depend on AI, what data crosses a boundary, whether an agent can act, who owns the outcome, which regulatory triggers apply, or what changed after the original approval.

The practical unit of control is therefore not simply the model or vendor. It is the AI use case in its operating context: the work being performed, the people affected, the information used, the system providing the capability, the authority delegated, the controls applied and the evidence generated.

The inventory is a control plane, not a register

Three current governance signals point in the same direction. NIST’s AI Risk Management Framework organizes operational risk management around Govern, Map, Measure and Manage. ISO/IEC 42001 treats AI as a management system that must be established, maintained and continually improved. In Europe, obligations already applying in 2026 include AI-literacy measures and Article 50 transparency requirements, while enforcement and later high-risk obligations make system context increasingly consequential.

What the inventory should contain

Inventory the use case, then link the components

A single enterprise platform can support hundreds of materially different uses. Conversely, one workflow may combine several models, retrieval systems, enterprise applications and human approvals. A model-only register therefore collapses the organizational context that determines risk and value.

The inventory should link reusable components—vendors, models, applications, connectors and data sources—to use-case records rather than duplicating everything. This permits a change in one component to reveal every affected workflow.

Ownership needs two axes

Technology ownership is not outcome ownership. The business owner remains accountable for the work, decision or service being changed. A technical/platform owner is accountable for the configured environment. Risk, privacy, security, legal or compliance functions own specific control decisions where relevant. The inventory itself needs a named steward who maintains the schema, completeness and review mechanism.

Do not wait for a perfect discovery exercise

The first inventory will be incomplete. That is expected. Start with sanctioned platforms, known automation/agent projects, procurement records, enterprise SSO/application data, security discovery, departmental surveys and targeted interviews. Then create a route for employees to register an existing or proposed use case without turning registration into a month-long approval process.

Shadow use is important precisely because it reveals demand that formal technology portfolios may not see. Repeated exceptions should therefore update the inventory and the approved environment, not disappear into an incident queue.

What should trigger reassessment?

This is why the inventory belongs in the operating system of AI transformation. A record that is reviewed only once a year cannot govern capabilities that change weekly.

A minimum viable inventory

An organization beginning now does not need a specialist governance platform before it can act. A controlled database, list or structured register can be sufficient if it has identifiers, owners, change history and disciplined review. Begin with these fields:

1. Use-case ID and status
2. Business owner and technical owner
3. Workflow / decision / intended outcome
4. Users and affected people
5. Provider, product, model and material configuration
6. Data classes and connected systems
7. AI authority level and human approval
8. Regulatory/risk classification
9. Required controls
10. Evaluation and operating evidence
11. Last material change
12. Next review / decision

The inventory is useful when a change can be traced to the work it affects—and the accountable owner can decide what to do next.

How the control system connects

Sources

• NIST — AI Risk Management Framework Playbook: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook
• NIST — AI Resource Center: https://airc.nist.gov/
• ISO — ISO/IEC 42001:2023 AI management systems: https://www.iso.org/standard/42001
• European Commission — AI Act enforcement framework: https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
• European Commission — AI literacy: https://digital-strategy.ec.europa.eu/en/policies/ai-talent-skills-and-literacy
• European Commission — Article 50 transparency obligations: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act

Related DENFORTH research: Shadow AI is an operating-model problem · Enterprise AI acceptable-use architecture · EU AI Act: enterprise implementation guide