The AI model inventory and governance register your supervisor expects you to keep
Know every AI system you build, buy or let staff use. Give each a risk tier, route it for the right approval, and show your board where the gaps are. Start free in your browser, or talk to us about the hosted team edition.
Inventory
One record per system, with owner, purpose, vendor, data location, oversight, validation and review dates. Import from a spreadsheet or add as you go.
Risk tiering
Five questions score each system from 1 to 3. The total sets a Low, Medium or High tier, with thresholds and review cycles you control, and overrides that need a reason.
Approvals
A simple workflow from idea to live, with approval needed from the right role for each tier, and checks that stop a high-risk system going live without validation.
How it supports supervisory expectations
Drawn from the Central Bank of the UAE's Guidance Note on Consumer Protection and Responsible Adoption and Use of AI and ML (11 February 2026), which is addressed to licensed financial institutions. The register is also good practice for any institution whose AI affects customers or other people. It supports your own governance. It does not make you compliant, and it does not replace advice.
| What is expected | How the register helps |
|---|---|
| A complete inventory of AI models, systems and technologies, with at least name, purpose and risk rating | One record per system, including AI embedded in vendor products and tools staff use. A dashboard shows how many records have the minimum fields complete. |
| A process to rate the risk of each AI system | Five scored questions turn into a Low, Medium or High tier, with a documented override and reason. |
| Board and senior management accountability, with regular reporting on performance and risk | A board report and a dashboard of gaps, ready to print or save as a PDF. |
| Risk and control functions able to challenge AI outcomes | An approval step for each tier, with the approver, decision, conditions and date recorded. |
| An inventory that includes third-party models, held to the same standards | Type, vendor and data location are recorded for built, bought, embedded and public tools. |
| Contracts with information and audit rights | A field for each third-party system, and a gap list for those without them. |
| Bias testing at least annually and when a model changes | Last bias test date for customer-facing systems, and a gap list for those with none. |
| Human oversight matched to risk (in, on or out of the loop) | An oversight model for each system, and a check before approval and go-live. |
| A clear and immediate ability to stop using an AI system | Records whether each system can be stopped quickly, and flags those that cannot. |
| Periodic independent review and validation | Validation status and dates, with high-tier systems blocked from going live until validation is complete. |
| Identification of high-impact decisions | A flag for decisions that materially affect access to a product or service. |
Two editions
Local edition
- Runs in your browser; the register stays on your device
- Inventory, scoring, tiers, approvals and workflow checks
- Dashboard of gaps, board report and inventory extract
- Audit log, CSV import and export, JSON backup
- Single user
Team edition (hosted)
- Several users with roles, and sign-in with your corporate identity
- A server-side audit log that cannot be edited by users
- Hosting in the UAE and encryption at rest
- Evidence attachments, reminders by email and an API
- Arabic and English
- Pricing on request
Thank you. A Kompass partner will contact you.
How we handle your data
- In the local edition everything you enter stays in your browser on your device. Kompass does not receive it.
- We ask for your work email once, so we can follow up. That is the only thing we receive.
- Clearing your browser data deletes the local register. Export a backup regularly.
- Do not enter passwords, keys or customer data. Link to evidence held in your own systems.
Questions
Is this a compliance tool?
No. It helps you keep and evidence your own governance. Whether you meet any requirement depends on how you use it and on the rules that apply to you.
Does it apply only to banks?
No. The expectations behind it are good practice for any organization whose AI affects customers or other people.
Can Kompass help us fill it in?
Yes. A free AI Governance Review shows where you stand, and a Kompass partner can run an AI governance readiness review. See our AI governance services.