Creating an AI Inventory

Introduction

As the use of Artificial Intelligence proliferates, the creation of an AI inventory is now a key part of an organisation’s data governance and ethical accountability records. It is indeed a recommendation within the Artificial Intelligence Playbook for the UK Government. It states that: “A live inventory will help your team, your organisation and your stakeholders understand the scope and scale of AI usage. It does this by providing better oversight and awareness of any potential risks such as data quality, model accuracy, bias, security vulnerabilities and regulatory compliance. An inventory will also be helpful for audit purposes.”

The Playbook sets out 10 principles (see below) to guide the safe, responsible and effective use of AI.

You may decide to maintain the inventory within your existing RoPA or Information Asset Register records, within an IT Asset Management system or using a dedicated spreadsheet, SharePoint list or database.

This short article explores the scope of information to populate an inventory so that it supports a range of operational, ethical and risk management purposes.

Principles from the AI Playbook

1. You know what AI is and what its limitations are
2. You use AI lawfully, ethically, and responsibly
3. You know how to use AI securely
4. You have meaningful human control at the right stage
5. You understand how to manage the AI life cycle
6. You use the right tool for the job
7. You are open and collaborative
8. You work with commercial colleagues from the start
9. You have the skills and expertise needed to implement & use AI
10. You use these principles alongside your organisation’s policies and have the right assurance in place

Use case definition

The use case and AI system utilised could be assigned to either a regular business process / activity or a specific (time-limited) programme of work.

You could record information relating to:

• The business problem to be addressed
• The purpose and objectives of deployment
• Data elements involved
• The business usage and scope of impact
• Business value metrics
• Efficiency gain metrics
• Documented successes and challenges
• The stakeholders involved and affected
• Summary of future development plans

System description

You could record information relating to:

• Vendor details
• Current operational status
• Description of AI capabilities
• System ownership
• The AI model used
• Data sources and inputs used to train and operate
• Data flows and processing activities
• Outputs and their use
• Security description / controls
• The hardware and software infrastructure
• Integration with other systems
• Cost information

Compliance and ethical considerations

You could record information relating to:

• Compliance with relevant laws and regulations relating to privacy and data protection, e.g. the GDPR
• Compliance with relevant laws and regulations relating to AI, e.g. the EU AI Act if applicable
• Privacy impact assessment outcomes
• Security assessment results
• Data quality assessment results
• Status of known limitations and potential biases
• Ethical risk assessments (e.g., bias, discrimination, copyright and privacy violations)
• Mitigation strategies
• Transparency and explainability relating to decisions and outputs

Operational and governance information

You could record information relating to:

• The deployment process
• Ongoing monitoring and maintenance procedures / schedules
• Testing and validation procedures
• AI system versions and updates record
• Change management processes
• Procedures for handling incidents, such as AI system failures or errors
• Record of operational evaluation and reviews
• Metrics for evaluating performance, e.g. relating to the AI system's effectiveness, accuracy, and reliability
• User satisfaction measures
• Human oversight measures
• Roles and responsibilities for AI system development and operation.
• Procedures in place for monitoring and auditing
• End-of-life considerations (including data retention)

How Informu can help

Informu Solutions provide a range of services and solutions to help you create and maintain an AI inventory, including:

• Creating the specification for the inventory record
• Undertaking audits, using our questionnaire platform if required
• Provision of a record-keeping inventory platform
• Coming soon – our carbon impact calculation, recording and reporting tool
• Creating or reviewing relevant policies and procedures

Thank you for reading.

Reynold Leming

Informu Solutions Limited

March 2025

Contact [email protected]