In plain English
You cannot govern what you do not know you have. An AI inventory records every AI system and model, including AI embedded in vendor products and public tools used by staff, and who owns each one.
At a minimum each entry should show the system's name, its purpose and a risk rating, which is the minimum the Central Bank of the UAE expects of licensed financial institutions in its 2026 guidance. Most institutions add the vendor, the data used, the level of human oversight, validation status and review dates.
Why it matters to a board
The inventory is the foundation for everything else. A board that has not seen it cannot know the scale of the institution's AI risk.
Common mistakes
- Listing only systems the technology team built.
- Compiling it from memory instead of reconciling it to procurement and change records.
- Having no named owner for each system.
- Never updating it.
What the standards and regulators say
- Central Bank of the UAE: Guidance Note on Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning (11 February 2026)
- NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1)