Governance

AI Inventory

Central register of AI use-cases and models.

How the laws define this

Regulatory authorities agree that an AI inventory is a centrally managed or maintained register documenting all identified AI models, applications, or systems alongside their third-party or vendor dependencies and a risk or materiality classification to enable oversight, lifecycle control, and risk management. Key differences arise in the specific information required within the register. The Guidelines on AI Risk Management for Financial Institutions (MAS consultation paper) emphasizes operational deployment stages, explicitly requiring firms to track systems in production and pilots. Conversely, FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence mandates recording technical characteristics, such as model family, data types used, and the degree of autonomy or adaptivity. Adding another layer of detail, the Artificial Intelligence Model Risk Management – Observations from a Thematic Review (MAS information paper) focuses on operational context, calling for entries to capture scope, purpose, inputs, outputs, and data lineage.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

Definitions (3)

A centralised register that documents each AI model or use-case, including scope, purpose, inputs, outputs, data lineage, vendor dependencies and materiality classification, to enable oversight, reporting and lifecycle control.

A maintained register of all AI systems in production, pilots and significant third‑party dependencies that firms must keep to enable consistent materiality assessments, oversight, and lifecycle documentation.

A centrally managed register that documents all identified AI applications (in‑house and third‑party), including data types used, model family, degree of autonomy/adaptivity, and an assigned risk/materiality classification; it must be kept current to support oversight and risk management.