⚡ Quick Summary
Co-authored by Kent Sokoloff (Chevron) and Hadassah Drukarch, Sez Harmon and Patrick McAndrew of the Responsible AI Institute, this guide addresses how medium and large organizations build and maintain an inventory of AI use cases for risk management and financial oversight. It sets out four aims: clarifying what an AI use case inventory is, explaining why maintaining one has become harder, outlining what an effective inventory looks like, and reviewing how regulations and standards can help. Opportunities for US regulatory bodies to improve AI inventory management are also highlighted.
The guide defines an AI use case through three factors — purpose of use, model type and scope of data — and argues that cataloging algorithms alone is insufficient, because models such as large language models are not limited to specific domains. Much of the difficulty is attributed to generative AI tools (ChatGPT-3 in 2022, ChatGPT-4o, Microsoft Copilot, Llama 3.1 and Gemini) that put AI in the hands of non-technical users, and to undisclosed third-party AI integrations and subcontracting.
Its conclusion is a use case-driven, risk-prioritised inventory rather than a complete one, supported by risk assessment, user training, transparency, human-in-the-loop review, contractual disclosure from vendors and frameworks such as the NIST AI Risk Management Framework, the EU AI Act and ISO 42001.
🧩 What’s Covered
- Defining an AI use case (2.1): Contrasts established IT application inventories with AI inventories, using an Excel-based spreadsheet as the edge case, and defines an AI use case through purpose of use, model type and scope of data.
- Challenges of comprehensive inventories (2.2): Links the difficulty to ChatGPT-3 (2022), ChatGPT-4o, Microsoft Copilot, Llama 3.1 and Gemini, which put powerful tools in non-technical users' hands, and lists restricted data in training, restricted data in prompts and uncontrolled internal sharing, with a HIPAA scenario as the boundary case.
- Third-party AI integrations (2.3): Examines opaque subcontracted AI services, non-AI vendors embedding AI, subcontracted voice generation and AI code assistants, then proposes four practices: clear inventory criteria, vendor transparency and disclosure, monitoring high-risk use cases, and focusing on dynamic, high-value systems.
- Identifying risk (3.1): Names the NIST AI Risk Management Framework, the EU AI Act, ISO 42001, Microsoft Responsible AI Principles and Approach and the MIT AI Risk Repository, and lists high-risk industrial areas including human safety, cascading failures, asset mismanagement, customer data misuse and market manipulation.
- Risk mitigation (3.2): Sets out training users, transparency, human-in-the-loop review and contract language requiring vendors to disclose training, data use and subcontracting.
- Where to draw the limit (4): Frames investment decisions as use case-based rather than application-based, cites the World Economic Forum report Unlocking Value from Generative AI, and covers risk assessment, duplicate projects, data scientist involvement and anticipating regulatory change.
- Conclusion, bibliography and authors (5, 13–14): Four key takeaways, the SOC 2 comparison, sources including GSA's AI Guide for Government and AICPA SOC 2 criteria, and author biographies.
💡 Why it matters?
Organizations cannot govern AI use they cannot see. This guide gives governance, risk and compliance teams a practical way to scope that problem: it explains why a use case-level inventory is more useful than an algorithm-level one, names concrete blind spots such as subcontracted vendor AI and employee use of generative tools, and sets out prioritisation criteria based on risk, data sensitivity and economic return. It connects inventory practice to frameworks many organizations already use — the NIST AI Risk Management Framework, ISO 42001 and the EU AI Act — and argues that standardised guidance could do for AI what SOC 2 did for SaaS.
❓ What’s Missing
The guide is deliberately high-level: it states that it does not delve deeply into specific risk mitigation methods and offers no inventory template, field list, scoring model or worked example of a completed inventory. It prints no publication date, version or licensing information, so which generative AI tools and regulatory developments it reflects is unclear. Its regulatory suggestions are framed around opportunities for US regulators, while the standards it names are international. Quantitative thresholds for "high risk" or "high data sensitivity", and the roles responsible for keeping inventories current, are left to the reader.
👥 Best For
Governance, risk and compliance leads scoping an AI inventory programme; data architects and AI programme owners deciding which use cases to register; and procurement or third-party risk teams negotiating AI disclosure clauses with vendors. It also suits executives who need a short, non-technical explanation of why AI inventories are harder than IT inventories and where to draw the boundary.
📄 Source Details
AI Inventories: Practical Challenges for Organizational Risk Management, co-authored by Kent Sokoloff (Chevron) and Hadassah Drukarch, Sez Harmon and Patrick McAndrew (Responsible AI Institute). The document names no publisher, publication date, version or reference number; the About section describes the Responsible AI Institute as a non-profit founded in 2016 and lists a media contact (Nicole McCaffrey, nicole@responsible.ai). The 14-page PDF ends with a bibliography. The full text of all 14 pages was available for this analysis.
