What is an AI Inventory and why should you build one?  

The EU AI Act entered into force on 1st August 2024. It is the world's first comprehensive AI legislation and advances the development, adoption and distribution of safe, trustworthy and responsible AI systems. Even though many provisions will not be enforced for another year, it is not too early to start adopting responsible AI practices and getting your organisation ready for compliance. This article will focus on helping organisations with a foundational first step: building an inventory of AI systems.

What is an inventory of AI systems? 

An AI Inventory, sometimes called an AI Register, is a detailed list of the AI systems developed and used within your organisation, including the specific use cases for those systems. An AI Inventory helps your organisation keep track of all its systems and the ways that it uses them, providing a full picture of the AI landscape within the organisation.  

The inventory should include useful information like which departments and teams use the system, what data they are processing, and how often they are assessed for compliance. Distinguishing between different use cases for each tool is also important. For example, an organisation may use a large-language, generative AI model for translation internally and content generation for external audiences. Here, each use case has a different risk profile and making this visible is key for compliance, risk and data governance professionals. 

Depending on the organisation’s size, processing activities and business practices, an AI Inventory can be recorded on a spreadsheet or an AI governance tool like Trilateral GRC Suite.

Why do you need an AI Inventory? 

Maintaining an AI Inventory is crucial to managing AI governance within any organisation, and helps to embed responsible AI practices and maintain compliance with relevant regulatory frameworks.  

There are many benefits of maintaining an AI Inventory such as: 

• It allows an organisation to see how AI is already being used across departments and better understand how to optimise AI deployment in a responsible way.  
• It sets the groundwork for comprehensive AI risk and quality management.   
• It will help in the systematic identification of an organisation’s role and its legal obligations for different AI systems.

Although there is no specific legal requirement to develop an AI Inventory within the EU AI Act, its existence underpins robust AI governance and supports the achievement of other compliance activities that are required (e.g., risk management).  

How is this different from the AI registries or the EU AI database? 

The EU and many national and local authorities are establishing public AI databases or AI registries (for example, Helsinki and Amsterdam) for some AI systems. These will be accessible to key stakeholders, such as  regulatory authorities, policymakers and the general public, to increase transparency and provide better AI governance. Registration requirements for these registries and databases are being developed by the relevant authorities.  

By comparison, an AI Inventory is an internal management tool that may contains information confidential to an organisation. An AI Inventory will not be shared publicly; however, having all relevant information about your AI systems collected in one place will help you comply with registration requirements as they come into effect.  

GDPR vs AI Act best practices? 

The EU AI Act does not replace the obligations that are contained within the GDPR. As advised by CNIL, these legislative frameworks are complimentary to one another. They govern two separate aspects of the data cycle: 

• GDPR applies to all processing of personal data, including but not limited to AI systems  
• AI Act lays down specific requirements that pertain to data processing through the use of AI, whether that data is personal data or not 

Therefore, compliance with the GDPR will not ensure blanket compliance of the EU AI Act or vice-versa. Instead GDPR compliance will facilitate and prepare the organisation for the EU AI Act.  For example, Article 30 of the GDPR requires organisations to maintain a record of processing activities (RoPA), which is a repository of information specifically for processing activities that involve personal data. A fully developed and updated RoPA can immensely help in building responsible AI practices and preparing to comply with the AI Act.  

RoPA vs AI Inventory 

In principle both the RoPA and the AI Inventory help organisations demonstrate transparency and accountability. They are both repositories of information and may be termed as living documents. While a RoPA provides an organisation the ability to understand how personal data is being processed, an AI Inventory assists in the overview and management of the use of AI tools within an organisation.  

The following details contained in a RoPA may contribute towards the development of an AI Inventory: 

• Description and purpose of processing activity 
• Categories of data subjects and types of data 
• Security measures 
• Presence of automated decision making  
• Provision of transparency information 
• Risk assessment of high risk personal data (Article 35 GDPR) 

Given this overlap, linking these two compliance documents, or investing in a tool that enables such cross-referencing, will build efficiency for compliance professionals. 

What should an organisation do next? 

Once an organisation has developed a comprehensive AI Inventory, the next step is to conduct a discovery activity or a detailed AI Audit of all AI systems. The audit will focus on assessing systems against key AI governance principles and forthcoming legal obligations, including those related to transparency and accountability. Trilateral Research has tools and expertise to support you in this process.  

It is important to note that maintaining an AI Inventory is a continuous process to ensure that the inventory is complete and the information updated, similar to the process of maintaining a RoPA. This may be an obligation that is included within a Responsible AI Framework or an Acceptable Use Policy for the organisation. These documents will support your organisation on your journey to build a responsible AI culture. 

How can we help? 

The AI Act is a complex legislation with multiple obligations and competing timelines. Trilateral’s Responsible AI team will assist your organisation to build your AI governance function and comply with the AI Act. In addition, our Trilateral GRC Suite platform can provide an organisation with the tools necessary to demonstrate a robust and thriving cultured based on data protection and responsible AI as its core pillars. For help designing your AI governance strategy or to find out  more about the AI Act, please contact any member of Trilateral’s team.  

You can also read more insights from Trilateral Research by following us on LinkedIn.