What AI exists in our organisation — including the AI we did not realise we had?
Baseline: 4Enhanced: 4Advanced: 210 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where you train or adapt the model (B1). Go as deep as your system letter, and implement in your mode.
Why it exists
Inventory everything that thinks for you — including the AI you never chose. You cannot govern, secure, or answer for what you cannot see, and in practice the AI you cannot see is most of it: the assistant that appeared inside your customer-relationship system after an update, the triage feature your ticketing tool switched on, the code helper inside your developers’ editors, and the tools your staff quietly subscribed to because they were useful. An inventory that captures only the AI you deliberately procured will miss the larger part of your real exposure. Build the inventory first; every other dimension of this framework assumes it exists.
Minimum attribute
Why you record it
System / asset name
The identity of the asset.
Type
Model / AI agent / connector to internal systems / AI embedded in purchased software / retrieval pipeline / dataset / standing instructions / automated check. Naming the type forces the new categories to be used.
Provider / vendor
Who you depend on; links to the Sourcing dimension.
AI Owner
The named accountable person; links to Roles. An asset without one is a standing risk indicator.
Data used
Which classes of data the system touches; feeds privacy assessment and access decisions.
Embedded third-party AI? (Y/N)
The most overlooked flag — AI that arrived as a feature inside software you already had.
Applicable regimes
Which data-protection or sector rules govern what the asset touches (for example, European data-protection law, health-data rules, financial-resilience rules); this drives where data may reside, how long it is kept, and what must be auditable.
Criticality
How severe the harm could be, how reversible the decisions are, how many people are affected.
Use-case classification
The risk class this framework derives from criticality: prohibited, high, limited, or minimal use.
Lifecycle status
Requested / under evaluation / approved / live / retired; links to the Lifecycle dimension.
Model version in use
Recorded so that a provider replacing the model becomes a visible event that triggers re-assessment.
What to actually do
Extend the asset register you already have; do not start a parallel spreadsheet. If you run a configuration register — the database where IT records its systems — extend it rather than duplicating it: add a flag for “this asset contains AI” and apply it to every tool that has acquired AI features, whether or not you bought it as AI. This is the single most overlooked step in AI governance: organisations inventory what they purchased as AI and miss what arrived as a feature update inside software they already owned. A parallel spreadsheet, by contrast, is born stale and dies unmaintained.
Add the asset categories your register has never heard of. Classical registers have no slot for the things that now matter most, so those things go uncounted. Create categories for: the models themselves, recording the exact version in use, because a provider can change the model and with it the behaviour; AI agents — any AI that takes actions rather than only producing text; the connectors that let an AI reach into your internal systems — your files, mail, calendars, and databases — which are both an asset and a door, and which almost no organisation inventories yet; the retrieval pipelines that let a model consult your own documents before answering, together with the document collections they draw on; and the standing instructions and automated checks that shape a model’s behaviour, which must be treated as governed configuration wherever they materially determine what the system does. Record datasets, and the pipelines that feed them, as assets in their own right — not as mere inputs.
Keep a bill of materials for any AI you build or adapt. For every system you train or substantially adapt, maintain an ingredients list — which base model it came from, which datasets trained or tuned it, which third-party components it depends on. This list is what lets you answer, in hours rather than weeks, the question “are we affected?” when a model or a dataset somewhere in the supply chain is found to be compromised, unlawfully sourced, or withdrawn. Without it, that question is answered by archaeology.
Govern the data’s life, not only the model’s. Give every dataset and pipeline in the inventory its own rules for how long data is kept, how its quality is checked, and how it is deleted — and make deletion reach the mathematical traces your AI systems derive from data, not only the original records. Data-protection regimes such as Europe’s give individuals the right to have their data erased, and that right does not stop at the database: if a person’s information was folded into the derived stores your AI consults, a deletion that never reaches those stores is an obligation you have not met.
Hunt shadow AI actively; a prohibition is not an inventory. A policy line saying “do not use unapproved AI” produces compliance on paper and adoption in the dark. Pair the rule with active discovery — scan expense reports for AI subscriptions, use the tooling that detects which online services your staff actually use — and open a no-blame channel through which people can register the tools they already rely on. You want the unknown AI on your register; you get it there by making registration safe and discovery routine, not by making usage confessional.
Use a standard format for the bill of materials. Produce it in a standard, machine-readable bill-of-materials format rather than a free-form list, so that it can be generated by the build process and read automatically by whatever scans it.
Controls
Baseline4 controls
Control 21
Maintain one central register of every AI asset.
BaselinePreventiveall rolesper system
What it is
Built on the register you already run, extended with the AI flag and the new categories — not a parallel list.
How to implement it · Minimum content
Built on the asset register you already run, with a “contains AI” flag added, not a parallel list
Fields: name, category, provider, model and version, purpose, AI Owner, users, data handled, connections to internal systems, lifecycle phase
Coverage: AI you bought, built, received as a feature update, or staff subscribed to themselves
Update on every new system, change and retirement
Review of completeness at least twice a year
How to start
Add an AI flag to your existing asset list and ask each department head to name the AI tools their team uses, including features inside existing software.
Evidence
The register and a dated export of it.
Mode: light / standard / full
light
Where no asset register exists, a single shared spreadsheet becomes the register, kept by a named person.
standard
The IT asset register is extended with the AI flag and fields, maintained by IT with input from AI Owners.
full
The configuration management database carries the AI flag and categories, fed by procurement and discovery processes.
Control 22
Assign an AI Owner to every asset.
BaselinePreventiveall rolesper system
What it is
No asset without a named accountable person; track exceptions as risks.
How to implement it · Minimum rules
Owner field mandatory: no register entry is approved without it
The owner is a named person, never a team or the provider
Assets include models, agents, connectors, datasets and pipelines, not only applications
Unowned assets get an interim owner and a deadline, and are logged as a risk
Reassign on departure or role change; check owner fields at each register review
How to start
Filter the register for blank owner fields and assign each one within two weeks.
Evidence
The register with the owner field complete and the list of exceptions recorded as risks.
Mode: light / standard / full
light
The owner-manager fills the owner column in the spreadsheet and holds any asset not yet assigned.
standard
The register's maintainer reports blank owner fields to the AI lead each month.
full
The register enforces the mandatory field and unowned assets raise an automatic risk entry.
Control 23
Tag every purchased tool that contains embedded AI.
BaselinePreventiveall rolesper system
What it is
Reviewed when vendors ship AI feature updates, because the tag decays otherwise.
How to implement it · Steps
List the software and services you already pay for, using finance and procurement records
Check each one's release notes and admin settings for AI features
Tag each tool with “contains AI”, naming the feature, whether it is switched on and what data it can access
Ask at every new purchase or renewal whether the product contains AI
Re-check the tag whenever a vendor announces an AI feature update
How to start
Take the list of software subscriptions from finance and check the ten most-used tools for AI features.
Evidence
Register entries with the embedded-AI tag and the date each was last checked.
Mode: light / standard / full
light
A named person checks the main tools twice a year and marks them in the inventory spreadsheet.
standard
IT tags tools in the asset register and re-checks them as part of release and renewal management.
full
Procurement and IT tag tools at purchase and track vendor feature announcements continuously, updating the register.
Control 24
Use the new asset categories.
BaselinePreventiveall rolesper system
What it is
Models with versions, agents, connectors, retrieval pipelines, datasets, pipelines, standing instructions, and automated checks all appear as what they are.
How to implement it · Minimum content
Models: provider, name and exact version in use
Agents: any AI that takes actions, and what actions it can take
Connectors: which internal systems an AI can reach (files, mail, calendars, databases)
Retrieval pipelines and the document collections they draw on
Datasets and the pipelines that feed them, as assets in their own right
Standing instructions and automated checks that materially shape the system's behaviour
How to start
Add these categories to the register and, for each existing AI system, record its model version and its connectors first.
Evidence
Register entries showing assets in each new category.
Mode: light / standard / full
light
Add a category column to the inventory spreadsheet and list each item as its own row.
standard
The asset register gains these categories, with Technology Owners responsible for completing them.
full
Categories are modelled in the configuration register with links between models, agents, connectors and data, populated automatically where possible.
Enhanced4 controls
Control 25
Classify every asset by criticality.
EnhancedPreventiveall rolesper system
What it is
Severity, reversibility, and breadth of impact, recorded and kept current.
How to implement it · Minimum content
Severity: worst plausible harm to people, money, data or operations, on a short scale (e.g. 1–4)
Reversibility: whether the effect can be undone, and how quickly
Breadth: how many people or processes are affected
Resulting criticality level (e.g. low, medium, high, critical) from a simple written rule
Assessor and date
Reassessment on any change of scope, data, users or autonomy
How to start
Agree a three-question scoring sheet and apply it to the ten most-used AI assets.
Evidence
The criticality field in the register with assessor, date and rationale.
Mode: light / standard / full
light
The owner-manager scores each asset with the three questions in the inventory spreadsheet.
standard
AI Owners score their assets and the AI lead checks consistency across them.
full
Criticality is set through the organisation's risk methodology and recalculated automatically when register fields change.
Control 26
Tag each asset with the regimes that govern it.
EnhancedPreventiveall rolesper system
What it is
So residency, retention, and audit obligations are visible at the asset, not discovered at the incident.
How to implement it · Minimum content
Data protection: whether personal data is processed, and under which applicable data-protection law
Residency: where data is stored and processed, and the locations permitted
Retention: periods required by the rules that bind the organisation
Audit and record-keeping obligations from sector rules or contracts
AI-specific rules that apply to the use case
Contractual obligations to customers that restrict how the asset may be used
How to start
Ask legal or whoever handles privacy to list the regimes that bind the organisation, then tag first the assets that process personal or regulated data.
Evidence
The regime tags in the register and the list of regimes they refer to.
Mode: light / standard / full
light
The owner-manager, with an external adviser if needed, adds a regimes column to the inventory spreadsheet.
standard
Legal or compliance defines the tag list and AI Owners apply it to their assets.
full
Regime tags are maintained in the configuration register from the regulatory tracker and drive automated residency and retention checks.
Control 27
Give datasets and pipelines their own retention, validation, and deletion rules — and make deletion reach derived stores.
EnhancedPreventiveall rolesper system
What it is
A deletion that stops at the original record is incomplete.
How to implement it · Minimum rules
Retention period for each dataset and pipeline, with the reason or obligation behind it
Validation on entry: source, completeness, duplicates, format and obvious errors
Deletion procedure covering original records, copies and backups on a defined schedule
Derived stores in scope: search and vector indexes, caches, summaries, logs, models tuned on the data
Erasure requests from individuals traced to every derived store, with confirmation recorded
Each deletion logged with date, scope and who performed it
How to start
For one retrieval pipeline, trace where a single document ends up (index, cache, logs) and write the deletion steps for each place.
Evidence
The retention, validation and deletion rules and records proving deletions reached derived stores.
Mode: light / standard / full
light
A named person keeps the rules in one document, deletes by hand and rebuilds indexes from cleaned sources where needed.
standard
Data owners set the rules per dataset and the Technology Owner executes deletion with a checklist covering derived stores.
full
Data-lifecycle tooling enforces retention and propagates deletions to derived stores automatically, with periodic verification.
Control 28
Derive and record the use-case risk class for every asset.
EnhancedPreventiveall rolesper system
What it is
The classification that determines which obligations in this framework apply to it.
How to implement it · Steps
Describe the use case: purpose, who is affected, which decisions it supports, how much it acts on its own
Apply the framework's criteria: effect on rights, money, health or safety; person-affecting; agentic; personal data
Record the class, the reasoning, the assessor and the date in the register
List the controls that the class makes applicable to the asset
Reclassify on any change of purpose, users, data or autonomy
How to start
Classify the systems already live, starting with any that make or support decisions about people.
Evidence
The risk class and reasoning recorded per asset in the register.
Mode: light / standard / full
light
The owner-manager classifies each use with a one-page checklist and records it in the inventory spreadsheet.
standard
AI Owners propose the class and the AI lead confirms it at approval.
full
The governance function confirms each class, with high-risk classifications reviewed by the committee.
Advanced2 controls
Control 29
Maintain the bill of materials for every system you build or adapt.
AdvancedPreventivedeveloperper system
What it is
Kept as a living record, generated where possible rather than written after the fact.
How to implement it · Minimum content
Base model: provider, name, version and licence
Datasets used to train or tune: source, version, licence, and whether they contain personal data
Third-party components: libraries, adapters and tools, with versions
Training or tuning runs: date and reference to the configuration used
Written in a standard machine-readable bill-of-materials format, generated by the build process
Updated for every new model version, and searchable to answer “are we affected?”
How to start
Add a step to the training or build pipeline that writes the bill of materials automatically for the next model version.
Evidence
The bill of materials for each model version and its generation record.
Mode: light / standard / full
light
The person who trains or adapts the model keeps a structured file next to each model version, using a standard template.
standard
The build pipeline generates the bill of materials and the Technology Owner checks it at each release.
full
Generation is mandatory in every build, results are stored centrally and scanned automatically against supply-chain alerts.
Control 30
Run continuous, automated discovery of unregistered AI.
AdvancedDetectiveall rolesper system
What it is
Discovery findings flow into the register and into the risk indicators, on a standing basis.
How to implement it · Minimum rules
Sources: web traffic to AI services, expense and card records for AI subscriptions, browser extensions, installed applications, AI features switched on by software updates
Automated runs, continuously or at least weekly
Each finding compared with the register; anything unregistered opens a ticket for registration or removal
Risk indicators: count of unregistered AI found and time taken to register or remove it
Findings handled without blame, alongside the open channel for staff to register tools themselves
How to start
Turn on the online-service usage reporting in your network or endpoint tools and compare the first month's list against the register.
Evidence
Discovery reports and the tickets showing how findings were resolved.
Mode: light / standard / full
light
Commission an external service or use the usage reporting built into the network equipment, reviewed monthly by a named person.
standard
IT security runs automated discovery and passes findings to the register maintainer and AI Owners.
full
A dedicated function runs continuous discovery integrated with the register and the risk dashboard.
Evidence
The register itself and its exports; the embedded-AI tags; bills of materials; the data retention and deletion rules and proof they reach derived stores; discovery reports; the no-blame intake records.