Direct answer
An AI inventory is a factual register, not a risk classification. Give each deployed or tested system a stable record that identifies the legal entities, accountable owner, intended purpose, users, affected people, data, providers, outputs, decisions, human checks, evidence dates and change history before applying privacy, security or AI-regulation conclusions.
Preparation sequence
- Define the inventory boundary and name every production, pilot and employee-use system in scope.
- Record the owner, provider, version, intended purpose, users, affected people, inputs, outputs and decisions.
- Map data sources, personal information, locations, vendors, access, retention and deletion.
- Document human oversight, evaluation, limitations, incidents, overrides, restrictions and escalation.
- Track provider terms, model or configuration changes, approvals, review dates and retirement conditions.
Decisions to record
Is the inventory unit specific enough?
Separate materially different products, model versions, configurations, purposes and legal entities so one record does not hide different data, users, decisions or controls.
Can every factual field be verified?
Link provider, purpose, data, location, access, retention, evaluation and human-oversight claims to a current contract, setting, test, architecture record or accountable owner.
What change requires a new review?
Name triggers such as a new purpose, model, provider, data category, affected group, automated decision, market, subprocessor, control, incident or material performance change.
How does the system leave the inventory?
Record the retirement owner, access removal, data export or deletion, contract closure, evidence retention, user communication and replacement dependency.
Evidence to organize
- System register with owner, provider, version, purpose and status
- Data, people, vendor, location, retention and access map
- Human-review, evaluation, limitation and escalation record
- Incident, override, change and approval history
- Evidence links, last verified date and retirement decision
Example decision record
System: an AI support assistant used by the Singapore sales team. Missing facts: the provider version, training-use setting and support-access locations are not recorded. Action: hold the regulatory classification open, collect those facts, test the human escalation route and date the evidence before approving wider use.
Use the result responsibly
This guide does not select a legal mechanism, determine compliance, validate a contract, calculate a legal deadline, or predict an outcome. Laws, procedures, facts, and provider terms change. Check the official sources and obtain qualified advice where the business decision requires it.
Official reference points
Reviewed 2026-09-02. These sources are starting points, not a complete statement of applicable law.