AI Initiative Inventory: The First Step to AI Governance

Open your laptop. Try to count the AI tools running across your organization right now. All of them, not only the ones in the official stack. The chatbot customer service spun up in March. The model finance uses to flag invoices. The plugin in HR that ranks résumés. The one a manager pays for on a personal card.

Most leaders can’t finish that count. They didn’t stop paying attention. AI stopped announcing itself.

Before the policies, the committees, and the dashboards, you need to know what you actually have. That means an inventory. Everything else in AI governance is built on top of it.

You Can’t Govern What You Can’t See

In 2024, the U.S. Government Accountability Office checked whether federal agencies could even say what AI they were running. Of 20 agencies reviewed, only five had a complete, accurate inventory. The other 15 had incomplete or inaccurate data.

The GAO concluded that without accurate inventories, the government’s management of its use of AI will be hindered by incomplete and inaccurate data.

These are agencies with budgets, mandates, and oversight, and they still couldn’t see their own AI.

The reason is specific to this technology. As the GAO put it, AI systems “pose unique challenges to such oversight because their inputs and operations are not always visible.” A spreadsheet shows its formulas. A model doesn’t. You can’t audit, secure, or assign accountability for something you can’t name.

Why Inventory Comes First — and What the Frameworks Actually Say

This isn’t a ClearPoint opinion. Every serious AI framework says the same.

The NIST AI Risk Management Framework, released as NIST AI 100-1 in January 2023, is the reference most U.S. public-sector teams start from. It names inventory directly. Its GOVERN function lists the outcome in plain words (GOVERN 1.6): “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.” GOVERN sets the culture, policy, and accountability that the rest of the framework runs on, and an inventory is one of its named outcomes.

Then comes MAP, the function that establishes context and frames risk. NIST is explicit about the order. The outcomes of MAP, it writes, “are the basis for the MEASURE and MANAGE functions.” You map what you have. Then you measure it. Then you manage it. Skip the map and the rest is guesswork. In NIST’s words, “without contextual knowledge… risk management is difficult to perform.” For the full walkthrough of all four functions, see our strategy-first guide to risk management frameworks.

One caveat: NIST calls this iterative, not a rigid checklist, and GOVERN runs through every stage. But the starting point isn’t in dispute. Context comes first, and context starts with a list.

The federal government turned that principle into law. Under Executive Order 13960 and the Advancing American AI Act, agencies must inventory every AI use case at least once a year, then post a public version of it. The current rulebook, OMB Memorandum M-25-21, replaced the earlier M-24-10 in April 2025. It keeps that mandate, names a Chief AI Officer to own it, and sharpens the risk practices for “high-impact” AI. The effort is working: the 2024 inventory ran past 1,700 use cases across 37 agencies, more than double the roughly 750 reported in 2023. In government, inventory is the floor.

This part we can show from our own data. An inventory is only as good as the owner attached to each line, and ownership is where our data shows the lift.

The same gap can sit on a different kind of line: a model making decisions about residents, patients, or students, with no one’s name next to it. The fix starts in the same place: a record, and a person attached to it. (We dug into this pattern in The Phantom Owner Problem.)

What Is Shadow AI — the Half You Didn’t Approve?

Some of your AI was chosen, reviewed, and signed off. Most of it wasn’t.

Shadow AI is any AI tool employees adopt on their own, without IT or governance approval, often feeding sensitive data into public models nobody vetted. It’s the shadow-IT problem with a far larger blast radius. IDC found in 2025 that 56% of employees use unauthorized AI tools, while only 23% use AI their organization actually governs. The AI you didn’t authorize is the AI you can’t govern. In the public sector, that can mean citizen PII in a chatbot, records-retention rules ignored, and no audit trail when someone asks how a decision was made.

A complete inventory is how shadow AI stops being invisible. Done right, it has three traits a spreadsheet usually lacks. It’s mandatory, so nothing is optional. It repeats on a schedule, so it never goes stale. It never lets a tool quietly vanish: retired systems get marked, not deleted. That last rule is what turns a list into a control. We cover the broader discipline in our complete 2026 guide to AI governance.

What Every Inventory Entry Must Capture

A tool name on a list isn’t an inventory. It’s a rumor. A real entry answers five questions, the same five the federal government now requires of itself.

These five line up with the NIST AI RMF: keeping the inventory is a GOVERN outcome (GOVERN 1.6), the named owner is GOVERN’s accountability, and the data, decisions, and risk tier are the context the MAP function asks you to document. The federal data dictionary even hands you the field names. You don’t have to invent the schema. You have to fill it in.

How Do You Build an AI Inventory? A Four-Week Sprint

The mistake is trying to build the perfect inventory on day one. You won’t. Start with what you can see, then widen the net. Four weeks is enough to move from “we’re not sure” to a living system. Two patterns hold almost every time we watch a team do this: the audit finds more than the survey ever will, and the tool nobody will put a name on is the one that should worry you most.

From Spreadsheet to System of Record

Most inventories start in a spreadsheet. That’s fine for week one, but a spreadsheet doesn’t enforce a review date, flag a stale owner, or produce the board report a regulator will eventually ask for.

This is where a system of record earns its keep, and it’s how teams use ClearPoint for AI governance. You don’t need a separate “AI module”; you treat each AI tool the way you’d treat any other strategic initiative. Every tool becomes a tracked entry with a named owner, a risk tier, a review cadence, and a live status, all on one scorecard. When a board member asks “what AI are we running, and who owns it?” the answer is one screen and a board-ready report in minutes, not a three-day scramble.

Add ungoverned AI tools on top of the plans and projects a team already runs, and a spreadsheet stops being a record. A system keeps it honest. If you want to see what that looks like with your own portfolio, request a demo.

See how ClearPoint would run your plan — book a demo

What Inventory Makes Possible

Inventory is the foundation, not the finish line. Once you can see your AI, the rest becomes possible: risk assessments, performance metrics, review cadences, incident response, the board update that doesn’t cause a panic. It’s the same discipline that underpins any serious strategic plan: you can’t execute on what you haven’t written down.

Without it, every other move is a guess. You write policy for tools you can’t name. You assign risk to systems you can’t see. You report on performance you never tracked.

A model in production with no owner is a liability with a login.

Start where every framework, every auditor, and every new law already starts. Count what you have. Name who owns it. Write it down.

Governance doesn’t begin with a policy. It begins with a list.

Frequently Asked Questions

What is an AI initiative inventory?

An AI initiative inventory is a complete catalog of every AI tool, model, and system in use across an organization. Each entry records a named owner, the data the system accesses, the decisions it influences, a risk tier, and its lifecycle status. These are the same fields the U.S. federal AI use-case inventory requires.

Why is an AI inventory the first step in AI governance?

You cannot govern what you have not inventoried. The NIST AI Risk Management Framework names inventory as a GOVERN outcome (GOVERN 1.6), and its MAP function then documents the context of each inventoried system, which the MEASURE and MANAGE functions depend on. The U.S. GAO found that agencies without accurate inventories could not effectively manage their use of AI.

What is shadow AI, and why does it matter for governance?

Shadow AI is any AI tool employees adopt without IT or governance approval, often feeding sensitive data into public models nobody vetted. IDC found in 2025 that 56% of employees use unauthorized AI tools while only 23% use governed AI. A complete, recurring inventory is how organizations surface shadow AI and bring it under governance. In the public sector, that protects citizen PII, records retention, and the audit trail.

What does each AI inventory entry need to capture?

Five things: a named owner (a person, not a department), the data the tool accesses and whether it leaves your perimeter, the decisions it influences, its risk tier (rights-impacting, safety-impacting, both, or neither), and its lifecycle status. Keeping them is the inventory outcome the NIST AI RMF places under GOVERN (GOVERN 1.6), they supply the context its MAP function documents, and they match the field names in the U.S. federal AI use-case data dictionary.

How long does it take to build an AI inventory?

A focused team can stand up a working inventory in about four weeks: survey every department in week one, audit SSO and procurement logs for shadow AI in week two, classify each tool with the five required fields in week three, and move from a spreadsheet to a system with owners, review dates, and board reporting in week four.