AI Inventory

An AI inventory is a comprehensive, maintained record of every AI tool, model, agent, and integration in use across an organization — what each one is, which team uses it, what data it touches, and whether it's been formally reviewed and approved. It's the foundational artifact underneath most other AI governance activity, because compliance monitoring, anonymization coverage, and risk assessment all depend on first knowing what actually needs to be monitored, protected, or assessed. An organization generally can't govern an AI tool it doesn't know exists, which is why an incomplete or outdated inventory is often the root cause behind other governance gaps in AI risk management.

Building and maintaining an AI inventory has become harder as AI adoption has decentralized. AI capabilities are now embedded inside existing cloud services, browser extensions, and individual employee workflows, often adopted with a single click rather than through a formal procurement process that would naturally surface the tool to a central inventory. This means an AI inventory today has to account not just for deliberately adopted, sanctioned AI tools, but for the harder-to-see category of AI use that happens without anyone specifically deciding to adopt it as an organizational tool.

A large enterprise responding to a customer's AI compliance due-diligence questionnaire is a clear example of why an inventory needs to exist before other governance questions can be meaningfully answered. The questionnaire typically asks something like "list every AI tool that touches customer data and describe how each is governed" — a question that's straightforward to answer if a maintained inventory already exists, and can take considerably longer to answer if it doesn't, since answering it from scratch means individually surveying teams and systems to reconstruct a list that should already have existed.

The same need shows up whenever an organization applies a new regulatory framework, such as the EU AI Act's risk-based classifications, across its AI use. Classifying systems by risk requires first knowing every AI system in scope — something an inventory should answer directly, rather than requiring a fresh discovery exercise each time a new compliance question arises. An organization without a current inventory often has to partially rebuild this list every time a governance question comes up, rather than maintaining it once and referring back to it.

There's no single mandated format, but a useful enterprise AI inventory typically captures a consistent set of fields for each system, so that entries can be compared, filtered, and reviewed the same way across the organization. Common fields include:

• AI system or tool name
• Owner or responsible team
• Business purpose — what the tool is actually used for
• Vendor or provider
• Underlying model or technology, where known
• Deployment environment (cloud, self-hosted, embedded feature within another product)
• Data types processed
• Sensitive or regulated data exposure (e.g., PII, PHI, financial data)
• Integrations with other systems or data sources
• Users or departments with access
• Geographic or jurisdictional use
• Risk classification, if the organization applies one
• Regulatory relevance (which laws or frameworks may apply)
• Human oversight in place for consequential outputs
• Security or privacy controls applied
• Approval status (reviewed, pending, unreviewed)
• Lifecycle status (active, deprecated, in pilot)
• Last review or monitoring date

These are typical fields organizations find useful, not a universal legal checklist — the right set depends on an organization's size, industry, and regulatory footprint. A smaller organization may track a subset of these; a heavily regulated one may extend the list further.

Building an inventory is less about the format of the spreadsheet or tool used to hold it, and more about establishing a repeatable process for finding, recording, and revisiting AI use across the organization.

1. Define what counts as an AI system. Decide upfront whether the inventory covers standalone AI tools only, or also AI features embedded inside existing software, browser extensions, and AI agents — this scope decision shapes everything that follows. 2. Identify known AI tools and systems. Start with what's already visible: tools procured through IT, systems named in vendor contracts, and AI features teams have flagged or requested. 3. Record ownership and business purpose. For each entry, assign a responsible owner and document what the tool is actually used for — an inventory entry without an owner tends to go stale quickly. 4. Map data and integrations. Document what data types each tool touches and what other systems it connects to, since this is what later governance and risk-assessment work will need. 5. Assess risk and regulatory relevance. Note which tools touch sensitive or regulated data, influence consequential decisions, or fall under a specific regulatory framework, so review effort can be prioritized accordingly. 6. Record controls and approval status. Capture what safeguards (anonymization, access controls, human review) are already applied, and whether the tool has been through a formal review. 7. Identify shadow AI and unknown AI use. Survey teams directly, review expense and procurement records for AI-related tools, and check network or cloud activity where possible, since a meaningful share of AI use is typically adopted outside formal channels. 8. Establish ongoing review and maintenance. Set a cadence for revisiting the inventory and, where possible, a way for new AI adoption to be captured as it happens rather than only at the next scheduled review — an inventory that's accurate once but never updated recreates the same gap it was built to close.

These three terms are related but answer different questions, and keeping them distinct helps clarify what each is actually for:

• AI inventory identifies what AI systems, tools, models, agents, integrations, and workflows exist, and how they're being used.
• AI governance establishes the policies, controls, oversight, and accountability structures applied to those systems.
• AI risk management identifies, assesses, mitigates, and monitors the risks associated with those systems.

In practice, these build on one another: governance sets the framework, the inventory tells you what that framework needs to cover, and risk management uses the inventory to prioritize where mitigation efforts matter most. AI compliance then draws on all three to demonstrate, when asked, that the organization's actual AI use meets its applicable obligations.

Without a maintained AI inventory, an organization's actual AI governance coverage tends to reflect whatever tools were remembered or discovered during the last review, rather than everything currently in use — which can create blind spots as new AI tools are adopted by individual teams faster than periodic manual surveys tend to keep pace with. This gap often surfaces at an inconvenient moment: a regulatory inquiry, a customer's due-diligence request, or an internal review following an incident, each of which effectively asks for an inventory on short notice.

This can compound because other governance controls — anonymization coverage, compliance monitoring, audit trail completeness — are generally scoped to whatever the inventory says exists. An incomplete inventory doesn't just create a documentation gap; it can make it harder to apply those downstream controls consistently, since they're only as complete as the list of tools they're being applied to.

With an AI Inventory Actively Maintained

• AI tools in use are documented in one place, including what data they touch and whether they've been reviewed
• Compliance questions, audits, and due-diligence requests can be answered from an existing record rather than reconstructed under time pressure
• Governance controls like anonymization and monitoring can be scoped more accurately, because what needs coverage is better understood
• New AI tools are more likely to be captured as they're adopted, rather than discovered later during a review

Without It

• Governance gaps become more likely, since new AI adoption can outpace periodic manual discovery efforts
• Regulatory inquiries and due-diligence requests can demand an inventory on short notice, at an inconvenient time to build one
• Downstream governance controls may only be as complete as an inventory that's missing categories of AI use
• An organization can have solid controls for known AI tools while having limited visibility into unknown ones

Questa AI treats visibility into connected AI tools as part of the foundation its governance dashboard is built on, giving organizations a way to see which AI tools and integrations are connected through its platform and what data types they touch, rather than relying solely on a manually maintained list. As tools are connected through Questa, that visibility is reflected in the governance dashboard, which can support — though not replace — an organization's broader AI inventory effort.

This visibility is also what makes Questa's other governance capabilities, including anonymization and compliance mapping, more meaningful at an organizational scale, since those controls are most useful when applied consistently across the tools an organization actually uses. Combined with jurisdiction-mapped compliance coverage, Questa is built to support organizations in maintaining an accurate picture of their connected AI use as part of a broader governance and compliance program.

• AI Governance
• Shadow AI
• Governance Dashboard
• Compliance Monitoring
• AI Risk (Risk Vectors)
• AI Compliance