Glossary
Updated
What is an AI inventory?
An AI inventory, sometimes called an AI registry, is the list every other part of AI governance works from. It records each AI system in use: tools staff use, models built in-house, AI products bought from vendors, AI features switched on inside existing software, and AI agents. For each one it notes what it does, who owns it and where it stands. You can't assess, control or report on AI you don't know about.
What should each record include?
At minimum: a name and description, a business owner, the purpose it's used for, whether it was built or bought and from which vendor, the models and data behind it, and its lifecycle stage, from idea through pilot and production to retirement. Then the governance details: its risk classification, its role under laws such as the EU AI Act, whether it processes personal data, and links to its assessments, risks and approvals. A record without an owner is the first thing to fix.
Is an AI inventory required?
Several assume one. The NIST AI RMF calls for mechanisms to inventory AI systems under GOVERN 1.6. ISO/IEC 42001 asks you to define which AI systems your management system covers. US federal agencies publish AI use case inventories under OMB M-25-21, and US bank supervisors expect a model inventory under SR 26-2. The EU AI Act doesn't name an inventory as such.
How is it different from a model registry?
A model registry is an engineering tool. MLOps teams use it to track model versions, training runs and deployments, and it usually holds only models the company built. An AI inventory is a governance record. It holds bought and embedded AI as well, and it tracks context: who owns the system, what it's used for, which rules apply and whether it's approved. The two connect, and importing models from a registry or cloud platform keeps the inventory current.
How do you build and maintain one?
Start from what you already have: vendor contracts and procurement records, the model registry, and a short survey of teams. Then route every new AI request through intake, so new systems join the inventory as they're approved. Then look for what nobody registered, because staff adopt AI tools faster than any survey can capture. Review owners and stages regularly, and retire records when systems are switched off. Our guide on how to build an AI inventory walks through each step.
In Enzai, AI discovery finds the AI tools in use across the company, agents import from Microsoft Copilot Studio, models import from platforms such as Amazon Bedrock, Azure AI Foundry and Databricks, and use case requests add records as they're filled in. You add what discovery finds to the same AI inventory and give each record an owner.
Example
A retailer's AI policy lists six approved tools. When it builds an inventory, it starts with procurement records and finds 14 contracts with AI features, then asks each department what else it uses. Marketing reports three free transcription tools used in client calls, and the HR team has built an agent that answers policy questions from the HR site. Each becomes a record with an owner. Two of the transcription tools are replaced by an approved one, the third goes through intake, and the HR agent is reviewed and approved with read-only access.