AI Inventory

An AI inventory is a comprehensive, documented record of every artificial intelligence tool used within an organization. It is the foundational element of AI governance — the first thing regulators, auditors, and governance committees ask for when assessing AI oversight.

Think of an AI inventory as analogous to a software asset register or a medical device inventory. Just as healthcare organizations track every medical device for maintenance, calibration, and compliance, organizations should track every AI tool for risk, data handling, and governance. Without this record, there is no systematic way to assess risk, ensure compliance, or manage vendor relationships.

An AI inventory is not just a list of tool names. It is a structured database that captures the context of each tool use: who owns it, what data it processes, what vendor provides it, whether it has appropriate agreements in place, and whether it has been formally approved. This context transforms a list into a governance tool.

For regulated organizations, the inventory serves a dual purpose. Internally, it enables risk assessment, vendor management, and policy enforcement. Externally, it demonstrates to regulators and auditors that the organization has a structured approach to AI oversight. When an auditor asks, What AI tools do you use and how do you govern them? the inventory is the answer.

The importance of an AI inventory becomes clear when considering what happens without one. Without an inventory, an organization cannot answer basic governance questions: How many AI tools are in use? Which ones process PHI? Which vendors have BAAs? Which tools have been formally approved? Which departments are using AI most heavily?

Without answers to these questions, governance is reactive. Problems are discovered after they occur — when a vendor changes terms, when a data breach happens, when an auditor asks for documentation. With an inventory, governance is proactive. Risks are identified before they materialize, vendor changes are tracked systematically, and audit requests are answered quickly.

The inventory also enables risk-based governance. Not all AI tools carry the same risk. An AI tool that drafts marketing copy from public information carries less risk than one that processes patient records. An inventory with data classification allows the organization to focus governance resources on high-risk tools rather than applying uniform oversight to everything.

For multi-location organizations like DSOs, an inventory provides visibility across sites. Without it, each location may adopt tools independently, creating inconsistent governance and compliance gaps. A centralized inventory ensures that governance is standardized across the organization.

Finally, an inventory is a living document. AI adoption is not static — new tools are adopted, usage patterns change, vendors update terms. An inventory that is built once and never updated quickly becomes inaccurate. The value comes from continuous maintenance.

An effective AI inventory should capture the following fields for each tool.

1. Tool Name and Description The name of the AI tool and a brief description of what it does. Include both the vendor product name and any internal name used by the organization.

2. Department and Owner Which department uses the tool and who is the internal owner responsible for the tool relationship. The owner is the point of contact for questions, reviews, and vendor communications.

3. Use Case What the tool is used for — draft patient communications, analyze financial data, generate marketing content, schedule appointments. The use case determines the risk level and applicable regulations.

4. Data Type What data the tool processes — PHI, financial data, confidential business data, personal data, or public data. Data type is the primary risk indicator and determines compliance obligations.

5. Vendor Information Vendor name, website, contact information, and account manager. Include the vendor compliance status — whether they have a BAA, SOC 2, HITRUST, or other certifications.

6. BAA Status For healthcare organizations: whether a Business Associate Agreement is in place. If the tool processes PHI and no BAA exists, it is a compliance violation.

7. Approval Status Whether the tool has been formally approved through the governance process. Status options: approved, under review, not approved, or unknown (discovered through shadow AI discovery).

8. Risk Level The assessed risk level — low, moderate, elevated, or high — based on data type, use case, vendor status, and output criticality.

9. Date Added and Last Reviewed When the tool was added to the inventory and when the entry was last reviewed and updated. This supports maintenance cadence and audit documentation.

10. Notes Any additional context — known issues, vendor communications, pending actions, or special considerations.

Building an AI inventory from scratch requires a multi-method discovery process. No single method will find all AI tools — combining approaches ensures completeness.

Employee Survey Survey employees to identify AI tools they use. Ask: What AI tools do you use for work? What do you use them for? What data do you enter? Frame the survey constructively — the goal is discovery and managed adoption, not punishment. Employees who disclose shadow AI should not face consequences for honest reporting.

Network Analysis Use network monitoring tools to identify traffic to known AI services. This can reveal AI tools that employees are using without disclosing. Network analysis is particularly useful for discovering tools that employees may not realize are AI (embedded AI features in existing software).

SaaS Subscription Review Review the organization SaaS subscriptions for AI features. Many existing tools — CRM systems, marketing platforms, communication tools — have added AI capabilities. These embedded AI features may process data in ways that require governance.

Department Head Interviews Interview department heads about AI tools their teams use. Department heads may be aware of tools that individual employees do not disclose in surveys. These interviews also help identify future AI adoption plans.

IT Procurement Review Review IT procurement records for AI-related purchases. This catches tools that were purchased through formal channels but may not have been added to a governance inventory.

Combining Methods Each discovery method has blind spots. Employee surveys miss tools employees do not want to disclose. Network analysis misses tools used on personal devices. SaaS review misses tools purchased outside IT. By combining methods, the organization builds a more complete picture.

Document the discovery process for audit purposes. Regulators and auditors want to see not just the inventory but how it was built — this demonstrates that the organization made a genuine effort to identify all AI tools.

An AI inventory is only valuable if it is current. AI adoption is dynamic — new tools are adopted, usage changes, vendors update terms. Without maintenance, the inventory decays and its governance value erodes.

Maintenance Cadence Review the inventory at least quarterly. More frequent reviews may be appropriate for organizations with rapid AI adoption. Assign a specific owner for inventory maintenance — typically someone in IT, compliance, or the governance committee.

Adding New Tools Establish a process for adding new AI tools to the inventory. When a new tool is approved through the governance process, add it to the inventory with all required fields. When shadow AI is discovered, add it with a note about its discovery and approval status.

Updating Existing Entries Review existing entries for changes: has the use case changed? Has the vendor updated terms? Has the data type changed? Has the BAA status changed? Update entries to reflect current reality.

Removing Retired Tools When a tool is no longer used, mark it as retired rather than deleting it. Retired tools may still be relevant for audit purposes — they show what was used, when, and why it was discontinued. Maintain retired tool records for at least the duration of applicable regulatory retention periods.

Reviewing Risk Levels As use cases and data types change, risk levels may change. A tool that initially processed only public data may later be used for PHI — changing its risk level and compliance obligations. Review risk levels during quarterly inventory reviews.

Reporting Generate regular reports from the inventory for the governance committee. Reports might include: total tools by risk level, tools by department, tools without BAAs, tools pending approval, and tools with recent vendor changes. These reports inform governance decisions and resource allocation.

Shadow AI — the use of AI tools by employees without formal organizational approval — is a universal challenge. In most organizations, shadow AI exists. The goal of discovery is not to eliminate it through prohibition but to bring it into managed governance.

Shadow AI exists because employees find AI tools useful and want to use them for their work. When the formal approval process is slow, restrictive, or unknown, employees adopt tools independently. This is not malicious — it is the result of employees trying to work more effectively.

The inventory should include shadow AI tools discovered through surveys, network analysis, or other methods. Mark these tools with a discovery note and an approval status of not approved or under review. The governance committee should then evaluate each shadow AI tool: can it be approved? Does it need a BAA? Does it need to be replaced with an approved alternative?

This approach — discover, document, evaluate, and either approve or replace — is more effective than prohibition. Employees who have their tools discovered and evaluated are more likely to cooperate with governance than employees who face punitive responses.

Over time, as the inventory and approval process mature, shadow AI should decrease. Employees will have approved alternatives, the approval process will be efficient, and the governance culture will encourage disclosure over concealment.

The inventory is not just a record — it is a governance tool that informs decisions across the AI governance program.

Risk Assessment The inventory provides the basis for risk assessment. Each tool in the inventory can be assessed for risk based on its data type, use case, and vendor status. Risk assessment results feed back into the inventory as the risk level field.

Compliance Reporting When regulators or auditors ask about AI oversight, the inventory is the primary response. It demonstrates that the organization knows what AI tools are in use, what data they process, and what safeguards are in place. A well-maintained inventory accelerates audit responses and demonstrates governance maturity.

Vendor Management The inventory tracks vendor information and BAA status, enabling systematic vendor management. The governance committee can use the inventory to identify vendors that need follow-up, agreements that need renewal, or vendors that present elevated risk.

Policy Enforcement The inventory supports policy enforcement by identifying tools that are not approved, tools processing data they should not, or tools without required agreements. Policy enforcement actions can be tracked in the inventory notes field.

Budgeting and Planning The inventory provides visibility into AI spending and adoption patterns. This information supports budgeting decisions, vendor consolidation efforts, and AI strategy planning.

Incident Response When an AI-related incident occurs — a data breach, a vendor outage, a compliance violation — the inventory provides immediate context: what tool was involved, who owns it, what data it processes, and what agreements are in place. This accelerates incident response and documentation.