PRACTICAL GUIDE · AI GOVERNANCE
An AI inventory
your team can maintain.
An AI inventory is a record of the systems and uses your organisation needs to oversee. Start with enough context to identify an owner, assess the use and know when to review it.
Download the planning templateCSV · Opens in a spreadsheet · Includes one fictional example
EIGHT USEFUL RECORDS
Capture the context
before the score.
A product name alone tells you little about how AI is being used. The same service can support several activities with different data, decisions and oversight needs.
- 01
System & supplier
A recognisable name, provider, product or model version, and a link to the relevant service record.
Can someone identify the exact service being reviewed?
- 02
Intended use
What the system helps people do, which team uses it, and who may be affected by its output.
Are different uses of the same tool recorded separately where their risks differ?
- 03
Business owner
The person accountable for the use case, with a team or contact route that remains usable when staff change.
Who can change the use, pause it or arrange a review?
- 04
Data & access
The categories of information entered or produced, who can access them, and the connected services.
What information leaves your organisation, and which terms apply?
- 05
Human oversight
Who checks outputs, the situations that require escalation, and any limits on autonomous actions.
What happens when an output is wrong or someone cannot complete the review?
- 06
Assessment & decision
A link to the assessment, the decision, the reviewer, the decision date and any conditions.
Can the owner explain the rationale and show the supporting records?
- 07
Controls & follow-up
The measures to put in place, evidence to retain, and actions with owners and dates.
Which conditions remain open before or during use?
- 08
Review & change
The next review date and changes that should trigger an earlier assessment.
Would a new provider, use case, data category or level of autonomy prompt a review?
A FICTIONAL EXAMPLE
A support drafting
assistant.
The useful record describes the task and its boundaries, rather than treating every use of a model as identical.
- Intended use
- Suggest draft replies to support agents. A person reviews every reply before sending it.
- Owner
- Customer support lead.
- Data to confirm
- Ticket text, personal information, provider processing and retention terms.
- Review condition
- Approve the permitted data categories and record the process for checking generated replies.
- Trigger for reassessment
- A move from drafting replies to sending them automatically.
Illustrative planning example. It is not an assessment or approval of any service.
KEEP THE INVENTORY USEFUL
Make updates
part of the work.
Ask owners to review records when they procure or change a service, introduce a new use case, change the data being processed or learn about an incident. Set a routine review date as well as these event-based triggers.
Keep open questions visible. An unknown retention period or missing business owner is something to resolve, rather than a blank cell to overlook. Assign the next action to a person and preserve the decision once it is made.
The downloadable template is a planning aid, not a direct Defensiq import format. Adapt it to your organisation and keep access appropriate to the information recorded. It does not determine a system’s legal classification or replace a formal assessment.
How this connects to Defensiq
AI Governance supports inventory records and assessments. Advanced adds the full decision, controls, evidence and follow-up workflow, with an eligible Business or Enterprise plan and the AI Governance add-on.
Explore AI Governance and availabilityYOUR NEXT STEP
Walk through one AI use case.
Bring the ownership, data and review questions you need to answer. We’ll explore the available workflow together.