AI Inventory and System Classification

Why AI Inventory and System Classification Matters
You cannot govern, audit, or secure what you do not know exists. For an Advanced in AI Audit (AAIR) professional, the AI inventory is the foundation of every downstream risk activity: risk assessment, control design, monitoring, regulatory compliance, and assurance reporting all depend on a complete and accurate picture of the AI systems in use. Classification then tells the organization how much governance each system deserves, so scarce audit and control resources go where risk is highest.

Regulators and frameworks increasingly make this explicit. The EU AI Act is built on a risk-tiered classification (unacceptable, high, limited, minimal). The NIST AI Risk Management Framework's Map function requires understanding context and cataloguing AI components. ISO/IEC 42001 requires organizations to determine the scope of their AI management system and maintain awareness of AI systems and their intended purposes. Without an inventory, an organization cannot demonstrate that it has even identified which obligations apply to it.

Common real-world failures include shadow AI (employees adopting generative AI tools or vendors embedding AI features without disclosure), untracked models drifting in production, duplicated models solving the same problem with inconsistent controls, and third-party AI buried inside SaaS platforms. The inventory and classification process is the primary defense against these gaps.

What an AI Inventory Is
An AI inventory (sometimes called an AI register, AI catalogue, or model inventory) is a centrally maintained, authoritative record of all AI systems, models, and AI-enabled services that the organization develops, procures, deploys, or materially relies on. It extends the concept of a traditional IT asset inventory or model risk management (MRM) model inventory to cover the unique attributes of AI.

Scope typically includes:
• Internally developed machine learning and statistical models
• Third-party and vendor-provided AI, including AI features embedded in enterprise software
• Generative AI and large language model (LLM) applications, including API-based use of foundation models
• Automated decision systems, robotic process automation with learning components, and recommendation engines
• Models in all lifecycle stages: proof-of-concept, development, validation, production, retired or decommissioned

Typical inventory attributes (data fields) include:
• Unique identifier and system name
• Business owner, technical owner, and accountable executive
• Business purpose and intended use (and explicitly prohibited uses)
• Lifecycle status and deployment date
• Model type and technique (e.g., supervised classifier, LLM, computer vision)
• Training data sources, data sensitivity, and personal data involvement
• Degree of autonomy and human oversight (human-in-the-loop, on-the-loop, out-of-the-loop)
• Affected stakeholders and decision impact (e.g., credit, employment, healthcare, safety)
• Third-party and supply chain dependencies, including foundation model providers
• Applicable regulations and jurisdictions
• Risk classification tier and date of last assessment
• Links to documentation: model cards, validation reports, bias testing, monitoring dashboards

What System Classification Is
Classification is the process of assigning each inventoried AI system to a risk tier based on defined criteria, so that governance requirements are proportionate. It operationalizes the principle of risk-based or proportionate governance that runs through the AAIR body of knowledge.

Common classification dimensions include:
• Impact on individuals – does the system affect rights, safety, access to essential services, or legal status?
• Decision criticality – is the output advisory, or does it directly drive consequential or automated decisions?
• Level of autonomy – how much meaningful human review occurs before action is taken?
• Data sensitivity – personal data, special categories, confidential or regulated data
• Scale and reach – number of users, customers, transactions, or geographies
• Reversibility – can harmful outcomes be detected and corrected quickly?
• Regulatory exposure – does it fall into a defined high-risk category (e.g., EU AI Act Annex III areas such as employment, credit, education, law enforcement, critical infrastructure)?
• Model complexity and explainability – opaque models generally warrant more scrutiny
• Supply chain dependency – reliance on external foundation models or vendor black boxes

Typical tiering schemes use three to five levels (e.g., Prohibited / High / Medium / Low, or Tier 1–4). Each tier is mapped to mandatory controls: for high-risk systems this may include independent validation, bias and fairness testing, documented human oversight, impact assessments (DPIA, algorithmic impact assessment, FRIA), enhanced monitoring, board-level reporting, and periodic audit. Low-risk systems may require only registration and basic acceptable-use controls.

How the Process Works
1. Define scope and the definition of "AI." The organization must adopt a clear, documented definition (often aligned to OECD/EU AI Act or ISO/IEC 22989 definitions) so that stakeholders know what must be registered. Ambiguity here is the leading cause of incomplete inventories.

2. Discover AI systems. Use multiple complementary methods: business unit surveys and attestations, procurement and contract reviews, software asset management and CMDB data, cloud and API usage logs (e.g., calls to LLM endpoints), network/CASB monitoring for shadow AI, code repository scans for ML libraries, and vendor questionnaires about embedded AI features.

3. Register and document. Populate the inventory with standardized attributes, assign owners, and establish a registration workflow integrated with project intake, change management, and procurement so new systems are captured before deployment.

4. Classify. Apply the risk classification methodology, usually via a structured questionnaire or scoring model, with review by a second line (risk, compliance, legal, privacy) for higher tiers. Document the rationale.

5. Map to controls and obligations. Link each tier to required controls, assessments, approvals, and regulatory obligations. Trigger required activities such as impact assessments and validation.

6. Maintain and monitor. Reclassify when intended use, data, model, autonomy, or regulation changes. Perform periodic recertification by owners, reconcile the inventory against discovery sources, and track decommissioning. Report inventory metrics (coverage, overdue reviews, tier distribution) to governance committees.

7. Assure. Internal audit tests the completeness and accuracy of the inventory, the consistency of classification, and the linkage to controls. Auditors should independently attempt to identify unregistered AI (e.g., by sampling vendor contracts or API logs) rather than relying solely on management's list.

Roles and Governance
• First line (business and technology owners): register systems, provide accurate attributes, maintain currency.
• Second line (AI governance office, risk, compliance, privacy, legal): own the methodology, challenge classifications, monitor completeness.
• Third line (internal audit): provide independent assurance over the inventory and classification process and use the inventory to build a risk-based AI audit universe.
• Board / AI governance committee: approve the risk tiering framework and risk appetite, receive reporting on high-risk systems.

Integration with Frameworks
• NIST AI RMF: Inventory and classification sit mainly in Map (context, categorization, intended purpose) and Govern (accountability, inventory policies), feeding Measure and Manage.
• ISO/IEC 42001: Supports scope determination, AI system impact assessment, and lifecycle management requirements.
• ISO/IEC 23894: Risk identification and analysis rely on an understanding of the AI system portfolio.
• EU AI Act: Classification determines obligations; high-risk systems require conformity assessment, technical documentation, registration in the EU database, logging, human oversight, and post-market monitoring.
• COBIT: Aligns with managing assets, configuration, and risk (APO12, BAI09, BAI10) and extends traditional IT asset governance to AI.
• Model Risk Management (e.g., SR 11-7): Financial institutions typically extend existing model inventories to cover AI/ML, but must add attributes such as autonomy, fairness, and generative AI risks.

Common Pitfalls Auditors Should Look For
• No agreed definition of AI, leading to exclusion of embedded or vendor AI
• Inventory maintained as a one-time spreadsheet with no refresh process
• Classification performed solely by the system owner with no independent challenge
• Tiering based only on technical complexity rather than impact on people
• Generative AI and employee use of public LLM tools omitted entirely
• No linkage between classification tier and actual control requirements
• Retired models still running in production or not removed from the register
• Lack of reclassification triggers when a model is repurposed for a new use case

Exam Tips: Answering Questions on AI Inventory and System Classification

Tip 1 – Remember the order of operations. ISACA exam logic generally follows: define scope → identify/inventory → classify by risk → assess risk → design proportionate controls → monitor. If a question asks what should be done first before assessing AI risk or designing controls, the answer is usually to establish or complete the AI inventory (or to define what constitutes AI). You cannot assess what you have not identified.

Tip 2 – Favor completeness and independent verification. When asked how an auditor should gain assurance over an inventory, the best answer involves independently corroborating completeness through alternative sources (procurement records, API logs, cloud usage, code scans), not simply reviewing management's register or interviewing the AI team.

Tip 3 – Classification is about impact, not just technology. Distractors often emphasize model complexity, accuracy, or algorithm type. The best answer focuses on the potential impact on individuals, safety, rights, legal obligations, and the criticality and autonomy of decisions. Complexity is a factor, but impact drives the tier.

Tip 4 – Proportionality is the guiding principle. If a question describes applying identical heavy controls to all AI systems, the deficiency is a lack of risk-based classification. Conversely, if a high-impact system receives only basic controls, the deficiency is misclassification or a missing link between tier and controls. Look for the answer that aligns control rigor to risk tier.

Tip 5 – Watch for shadow AI and embedded AI scenarios. Questions describing employees using public generative AI tools or vendors adding AI features to existing software are testing whether you recognize an inventory completeness gap. The best response typically involves updating the definition/scope, adding discovery mechanisms, and bringing these systems into the register and classification process, not simply banning the tools.

Tip 6 – Know the reclassification triggers. Change in intended use, new data sources, a move from advisory to automated decisions, expansion to new jurisdictions, or new regulation should prompt reclassification. If a scenario describes a model being repurposed, the correct answer is to reassess its classification before continued use.

Tip 7 – Assign accountability correctly. Business owners are accountable for registering and keeping their systems current; the second line owns the methodology and challenge; internal audit provides independent assurance and should not own or maintain the inventory itself (independence). Answers suggesting internal audit maintains the register are usually wrong.

Tip 8 – Map to frameworks when prompted. If a question references NIST AI RMF, associate inventory and categorization with the Map function (supported by Govern). For the EU AI Act, associate classification with risk tiers and the obligations attached to high-risk systems. For ISO/IEC 42001, associate it with scope determination and impact assessment.

Tip 9 – Choose the most comprehensive, governance-level answer. ISACA questions reward answers that address root cause and process rather than a one-off fix. "Implement a policy requiring registration and classification of all AI systems integrated with procurement and change management" beats "Ask the data science team to list their models."

Tip 10 – Read for the key word. "Primary," "first," "most important," "best," and "greatest risk" change the correct answer. A missing inventory is typically the greatest governance risk because it undermines every other control; an inaccurate classification is the greatest risk when the inventory exists but controls are misaligned to actual impact.

Quick Recall Summary
• Inventory = what AI exists, who owns it, what it does, what it depends on.
• Classification = how risky it is, based mainly on impact, autonomy, data sensitivity, scale, and regulatory exposure.
• Purpose = enable proportionate, risk-based governance and demonstrate regulatory accountability.
• Auditor focus = completeness, accuracy, currency, independent challenge of tiers, and traceable linkage from tier to controls.
• Lifecycle = inventory and classification are continuous, not one-time; reclassify on change.