Exercise · 15 min · Lesson 7 of 9
Build your AI inventory
A list of every AI tool in your team, with purpose, data and risk level.
Your task
Create a table with seven columns: tool, owner, purpose, users, data involved, your role under the Act and risk level. Fill in at least five rows for your team, including one tool that was never officially approved. Mark every row that involves personal data or decisions about people, and for each marked row write one sentence on who reviews the output before it is used.
Guidance
You cannot manage what you have not listed. An AI inventory is the starting point for compliance and sensible governance: which systems are used, by whom, for what, with which data and at what risk level.
Include the tools people actually use, not only the ones that were officially procured. Shadow AI, meaning personal accounts and browser extensions used for work, is often the largest part of the real picture.
Your notes
Key takeaways
- An inventory is the first step of AI governance.
- Shadow AI belongs on the list too.
- Flag personal data and decisions about people for extra oversight.