Before you start

Have the system’s intended use, ownership and deployment context available. You need the appropriate AI governance permissions.

Step by step

  1. Open AI Governance and find the AI system in the inventory.
  2. Create or update the system record using the available fields. Record its purpose and accountable owner.
  3. Review classification, risks, mapped controls and impact assessment information.
  4. Link supporting policies and evidence. Use readiness reviews to identify gaps rather than treating missing evidence as a pass.
  5. Record human decisions and maintain the system when its use or risk changes.

Describe the actual use of AI

Distinguish the vendor/model from your organisation’s use of it. Record purpose, owner, data, users and deployment context using the available fields. Risk depends on the application, not just the model name. Keep unknown information explicit instead of selecting low-risk answers to finish.

Review material change

  1. Inspect the current system and owner.
  2. Check risks, impact assessment and controls against the actual deployment.
  3. Link supporting information and record authorised decisions/actions.
  4. Revisit when model, purpose, data or affected users change.

Connect governance and monitoring

Monitoring observes configured metrics and changes; it does not replace impact assessment or deployment approval. Assign responsibility for investigating signals. An internal readiness programme and an inventory entry answer different questions; neither establishes certification by itself.

What happens next

The inventory provides context for assurance reviews and monitoring. Keep the record aligned with the system’s actual use.

If something does not look right

If a classification or recommendation is unclear, inspect its evidence and rationale. Escalate material uncertainty to the accountable owner before approval.