Guide · AI in Institutions
Build an AI inventory with owners, evidence and a review cycle
You cannot govern AI you have not listed. An AI inventory with owners, data, effect on people and review dates is the first control every organisation needs.
The short answer
List every AI system and use, including tools staff adopted on their own. For each, record an owner, the data it uses, whether it affects decisions about people, how its output is reviewed and when it was last checked. Then review the highest-risk uses first.
What to record
- System or use: what it does, in plain words.
- Owner: one accountable person.
- Data: public, internal, personal or sensitive personal data.
- Effect on people: drafts or assists, informs decisions, or decides.
- Human review: always, sampled or none.
- Last reviewed: a date, or “never”.
Finding what is really in use
Ask teams what they use, not what is approved. Browser-based chatbots, translation services and AI features switched on inside existing software are all in scope. An honest inventory is more useful than a tidy one.
A worked example
The AI inventory template opens with four uses in an NGO. Screening job applications has no owner, uses personal data, decides about people and has no human review: it rises to the top of the review queue. Drafting donor reports, reviewed every time, sits at the bottom.
Then govern it
The inventory feeds the rest of governance: the policy, the review rhythm and any legal assessment. The AI governance framework template assigns those controls to the roles you have.
What this guide does not cover
An inventory orders your oversight work. It does not classify systems under the EU AI Act or any other law; that needs a separate assessment.
Responsible for this guide
Examples in this guide are illustrative, not client results. Figures come from the free tool’s worked example; change the inputs in the tool to see your own.
Related services
The same method, delivered with you: scoped in writing, with a named principal and a fee agreed before any work begins.
AI-readiness and AI-governance assessment
We map how one team or institution already uses AI, where data and decisions are exposed, and which governance gaps matter most. Diagnostic recommendations are kept separate from implementation, so you decide what to fund next.
See the serviceServiceFractional Chief AI Officer
A defined monthly cadence of AI decisions and oversight for firms that need senior AI leadership but cannot justify a full-time executive: priorities, owners and actions, reviewed on a fixed rhythm.
See the serviceMore from AI in Institutions
6-minute readWhat to define before automating a workflow 
6-minute readFrom an AI-use policy to decisions staff can actually follow 
7-minute readHow to evaluate an internal knowledge assistant before release 
6-minute readCalculate automation value after exception handling and running costs Also in Regulation Watch.
What needs to move forward?
Tell us the decision, the challenge or the opportunity. We reply with a scoped approach, a named principal and a fee before any work begins.
No charge to submit an enquiry.