{"slug":"ai-system-inventory","id":"AIPT-CTL-0009","title":"AI system inventory and classification","kind":"process","kind_label":"Process","purpose":"Ensures the organisation knows every AI system it builds, buys or embeds, who owns it, what it is for and which legal risk tier it falls into, so that obligations can be assigned rather than discovered after the fact.\n","description":"A central register is populated through intake forms, procurement gates, code and vendor scans and periodic attestations from business units. Each entry records the owner, purpose, users and affected people, the jurisdictions it operates in, the models and vendors involved, the personal-data involvement and the current lifecycle status. A classification step assigns a risk tier using the organisation's own criteria and the categories defined by applicable law, and the tier drives which further controls apply. Shadow-AI discovery and a rule that nothing goes live without a register entry keep the inventory current.\n","owner_role":"AI governance lead","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["6.5","7.4"],"evidence":[{"type":"register_entry","title":"AI system register","description":"One row per system with owner, purpose, risk tier, jurisdictions, vendors and status."},{"type":"approval_record","title":"Risk-tier classification sign-off","description":"Reviewer confirmation of the assigned tier and the rationale."},{"type":"procedure","title":"AI intake and classification procedure","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.1, 4.3, 8.1; Annex A.6.2.2, A.9.4","note":"Editorial mapping to scope, operational planning and intended-use records.","confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 1.1, 1.5; GOVERN 1.6","note":null,"confidence_level":"high"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0023 AI Bill of Materials","note":null,"confidence_level":"low"}],"obligations":[{"slug":"eu-ai-act-prohibited-practices","title":"Do not deploy or provide AI for prohibited practices","relationship":"supports","note":"A complete register is the population to be screened.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices"},{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","relationship":"supports","note":"Register with evidence links for third-party review.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"supports","note":"Inventory records the organisation's role for each system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","relationship":"satisfies","note":"Classification with recorded rationale per system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation"},{"slug":"us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","title":"Health-care providers must disclose the use of AI in patient services","relationship":"supports","note":"Identifies clinical and administrative systems that use AI.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"supports","note":"Intended purpose, users and settings recorded at intake.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","relationship":"supports","note":"Classification of systems against the high-impact list.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","title":"AI business operators must notify users in advance that a product or service runs on high-impact or generative AI","relationship":"supports","note":"Classification identifies which products are high-impact or generative.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","relationship":"supports","note":"Named owner for each AI system.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-colorado-ai-act-deployer-public-statement","title":"Deployers must publish a statement about the high-risk AI systems they use","relationship":"supports","note":"Source of the list of deployed high-risk systems.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement"},{"slug":"us-omb-m-25-21-use-case-inventory","title":"Publish an annual AI use-case inventory","relationship":"supports","note":"Vendor-side register supplies the use-case descriptions agencies ask for.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory"}],"related_controls":["ai-governance-policy-and-accountability","ai-risk-assessment","prohibited-use-screening-gate","public-sector-ai-use-case-register"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-system-inventory","context_url":"https://aipolicytracker.org/controls/ai-system-inventory.md"}