Ask most organizations for their AI inventory and they will produce a list of the initiatives a project went through approval for: the chatbot, the recommendation engine, the internal drafting tool. An ISO 42001 auditor asking the same question is asking for something wider, and the gap between the two lists is usually where a first audit finds its biggest surprise.The Inventory That Actually ExistsAI capability increasingly arrives embedded in tools an organization already licenses — a search product that added generative summaries, a CRM that added a scoring model, a support platform that added an assistant — none of which went through an 'adopt AI' decision at all. An inventory built only from approved projects misses every one of these, and they are exactly the use cases with the least oversight behind them.Building an Inventory That Would Survive an AuditAsk vendors directly, not just staff: a supplier questionnaire that asks whether AI is used in the service, and how, surfaces embedded capability a user-side survey never will.Include what was tried and shelved: a pilot that never reached production can still have left data exposed to a third-party model during the trial, which is exactly what an audit asks about.Record the decision, not just the system: who approved each use case, on what basis, and what risk assessment (if any) preceded it — the inventory is evidence of governance, not just a list of tools.Revisit it on a cycle, not once: a vendor can add AI capability to an existing product with a routine update; an inventory compiled once for certification is stale within a quarter.“An inventory that only lists what was formally approved is not an AI inventory. It is a list of the AI the organization already knew about.”Where to StartThe most efficient starting point is usually the procurement and vendor-management function, not IT: most embedded AI capability arrives through a contract renewal or a feature update to a product already in use, and procurement is the one function that sees every one of those renewals cross its desk.Share this articleX (Twitter)LinkedInFacebookCopy Link
ISO 42001Aug 27, 2026Preparing for ISO 42001 Without Overbuilding the AI Management SystemMost organizations approaching ISO/IEC 42001 for the first time either bolt AI governance onto an existing ISMS as an afterthought, or build a second management system nobody has the resourcing to run twice.
AI GRC WorkflowsJun 25, 2026Where AI Governance Actually Belongs in a GRC ProgrammeStanding up a separate AI governance committee is the easy part. Connecting its decisions to the risk register everyone else already reports against is the part that determines whether it matters.
AI SecurityJul 30, 2026The Model Supply Chain Most Security Reviews MissA security review that stops at the application layer never asks where the model came from, what it was trained on, or what changed the last time it was fine-tuned.
