Building an AI system inventory
By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · AI Governance
Every AI governance framework starts the same way: know what AI you actually run. The inventory is the map the rest of governance draws on.
Why it comes first
ISO 42001, the NIST AI RMF, and the EU AI Act all assume you know what AI systems you operate. You cannot classify risk, run impact assessments, or monitor models you have not catalogued. The inventory is the foundational artifact — the same role the asset inventory plays in security.
What to record
- Each AI system or feature: its purpose, owner, and lifecycle stage (in development, in production, retired).
- Whether it is built in-house, fine-tuned, or a third-party model/API, and which vendor.
- The data it is trained on and operates over, and its risk classification.
Include the AI you bought
The hardest part is the AI embedded in tools you did not build — a vendor feature now powered by an LLM, an AI assistant a team adopted. These carry real governance and data risk and are exactly the ones that go uncatalogued. Treat third-party AI features as inventory items.
Keep it current
A point-in-time list rots as teams ship and adopt AI. Make adding or changing an AI system trigger an inventory update, and reconcile periodically. SentinelPanda tracks the AI system inventory and links each system to its risk assessment and controls.