Which AI systems are actually running in our organisation?
You cannot govern what you cannot see. We build the register of every AI system in use — owner, purpose, risk class — so that governance decisions are based on reality instead of guesswork.
Last reviewed:
Sound familiar?
- Nobody can produce a list of AI systems in use when a customer, auditor or regulator asks for one.
- Systems get built into products, workflows and vendor tools without anyone flagging them as 'AI' in the first place.
- Without a named owner per system, incidents and update decisions have nobody to land on.
- Risk classification, where required, cannot happen without knowing what exists to classify.
What we do
Discovery
Interviews, tooling reviews and procurement records combined to surface AI systems that were never formally logged.
Register structure
A practical register format — owner, purpose, data used, risk class, review date — that survives beyond the initial workshop.
Risk classification
Each system assessed against a consistent risk framework, distinguishing internal tools from customer-facing or high-stakes systems.
Maintenance process
A trigger-based update process — new tool, new use case, vendor change — so the register doesn't go stale after the first version.
Questions we get
Does a spreadsheet count as an inventory?
It can, as long as it has an owner, a defined update trigger, and someone actually checks it. The format matters less than whether anyone maintains it.
What counts as an 'AI system' for this purpose?
Anything from a third-party SaaS feature with an AI toggle to an internally built model. We use a broad definition first, then narrow it during risk classification.
How long does building the first version take?
For a mid-sized organisation with a handful of departments, typically two to three weeks including discovery interviews.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call