How to build an AI inventory that survives an audit

Every AI management system starts with the same question: what AI do we actually have? You cannot scope, assess or control what you have not found. An inventory is also the record that risk assessments, the Statement of Applicability and audit evidence all hang from.

What to record for each system

Keep it small enough that people will maintain it. For each AI system, record:

• Purpose. What it is used for, in a sentence.
• Owner. A named person who is accountable for it.
• Source. Built in-house, bought, or an AI feature inside other software.
• Data used. What goes in, and whether it includes personal or sensitive data.
• Who it affects. Customers, staff, applicants or the public.
• Status. In development, in use, under review or retired.
• Your role. Your position in the value chain for that system.

Declared and discovered

Teams will not tell you about everything. Treat the inventory as two lists.

The declared list is what teams register themselves. Make it easy: a short form, one owner per system, and a clear rule that anything in use must be on it.

The discovered list is what you find that nobody declared. Look at software and browser extensions in use, API keys and cloud accounts, expense claims for AI subscriptions, and what vendors have switched on in tools you already pay for. Each finding needs a decision: approve it, replace it or stop it.

Compare the two lists regularly. The gap between them tells you how well policy matches practice.

Publish what is approved

Once findings are triaged, publish a short approved tools list that staff can check before they use something new. A clear "yes" list does more than a long prohibition.

Keep an eye on usage and cost

Usage data helps too. Token counts and spend by model, and by API key, show where AI is really being used and sometimes surface keys nobody remembers creating. Treat cost figures as estimates unless they come straight from the provider.

Keep it alive

An inventory that is only updated before an audit is out of date the moment it is finished. Tie it to events that already happen: onboarding a supplier, starting a project, renewing a contract. Archive retired systems so counts stay honest, and review the full list at least once per management review cycle.

From inventory to action

Once the list exists, everything else gets easier. Each system can be assessed for risk and impact, mapped to Annex A controls, given an owner for its evidence, and included or excluded from your certification scope for a reason you can explain.

If you would like to see how this works in practice, take a look at the step-by-step journey in the LeadAI Assure platform, from the free readiness check to surveillance.

This article gives general information and is not a substitute for ISO/IEC 42001:2023 or professional advice.