What counts as an AI system for the inventory?

Anything where AI makes or shapes an output your organization relies on: third-party assistants, AI features inside other products, models you build, and APIs your code calls. If in doubt, record it; a short entry marked minimal risk costs little.

Can we import an existing spreadsheet?

Records can be created by hand or from discovery findings today. If you have a large existing register, talk to us and we will help you load it.

Who can change a record?

Owners, admins and compliance managers manage the inventory. Viewers have read-only access, enforced by the server. Every change is in the audit log with the person and the time.

One record for every AI system. Owner, purpose, data, risk.

Every AI framework starts from the same place: know what you have. The GhostAudit inventory is that register, kept current by discovery and usage data instead of by an annual spreadsheet exercise.

Start 14-day trial

Example workspace. Names and figures are illustrative.

AI inventory

38 systems · 21 vendors

System	Owner	Data	Risk tier	Status
Candidate screening HireVue	People operations	Restricted	High	Sanctioned
ChatGPT Enterprise OpenAI	IT	Confidential	Limited	Sanctioned
Support assistant Intercom	Customer support	Confidential	Limited	Sanctioned
Claude Anthropic	Engineering	Internal	Limited	Under review
Cursor Anysphere	Unassigned	Confidential	Limited	Unsanctioned
Grammarly Grammarly	Marketing	Internal	Minimal	Sanctioned

01The record

What an auditor wants to see about each system, in one place.

An inventory is only useful if each entry answers the questions that follow from it. Who is accountable for this system? What is it for? Whose data goes into it, and how sensitive is that data? Does a person review its output before it affects anyone? When was it last looked at?

Each GhostAudit record holds the vendor, the owner, the purpose and usage context, the AI capability, the data sensitivity, the oversight controls in place, the risk tier and the review cadence. Fields that are missing are visible as gaps, not hidden.

Records are created by accepting a discovery finding or by hand. Either way, once a system is in the inventory its real usage, from the sensors, sits next to what you have declared about it.

Owner and department for every system
Data sensitivity: public, internal, confidential or restricted
Oversight controls and open control gaps
Status: sanctioned, under review, unsanctioned or prohibited

Example workspace. Names and figures are illustrative.

Candidate screening

Sanctioned

Vendor: HireVue
Owner: People operations · A. Moreau
Purpose: Ranks applicants for customer-support roles against the posted requirements
Affects: Job applicants in the EU, New York City and Colorado
Data: Restricted · personal data
Human oversight: Recruiter reviews every ranked list before contact
Risk tier: High
Last assessed: 6 Nov 2026 · next review in 90 days

Regulations that apply, and why

EU AI Act · Annex III high risk · matched on employment useFrom 2 Dec 2027
NYC Local Law 144 · matched on employment useIn force
Colorado SB 26-189 · matched on consequential decisionFrom 1 Jan 2027

02Risk

A risk tier you can explain.

Each system carries a risk tier, minimal, limited or high, and a score behind it. The score comes from attributes on the record: what the system does, what data it handles, who it affects and which controls are in place. You can see how it was derived and you can override it, with the change recorded.

The tier drives what happens next. High-risk systems are reviewed more often, are the ones the assessments page pushes you to complete first, and are the ones that appear in the board report. A tier is also the first thing a regulation asks about: the EU AI Act's obligations depend on whether a use is high-risk, and US state laws on automated decisions depend on whether the decision is consequential.

Example workspace. Names and figures are illustrative.

Cursor · set status

Applies at next sensor check-in

SanctionedAllowed. Counted in usage.

Under reviewAllowed while under review.

UnsanctionedEmployees see a warning with your guidance.

ProhibitedBlocked in the browser, if blocking is on.

03Applicability

Which laws reach each system, and the reason why.

The inventory is what the regulation tracker reasons over. For each system it shows the obligations that apply and the rule that matched, for example "employment use" or "interacts with customers", so that a lawyer can check the reasoning and disagree with it.

Matches are either direct, based on an attribute you set, or potential, based on a circumstantial signal such as a tool being used by the HR department. Potential matches are shown separately and wait for a person to confirm them.

04Outputs

From register to report without retyping.

Because the inventory is structured, it can be turned into the documents people ask for. The AI system inventory report is generated from it directly: the full register with risk distribution, data sensitivity, owners, control coverage, review schedule and vendor concentration. The acceptable use policy lists your approved systems from it. System cards, impact assessments and vendor assessments start from the record of the system they describe.

See all seventeen templates on the documents page, and what auditors look for in an inventory in our guide.

AI system inventory report
Inventory and reporting · whole organization
Complete register of AI systems with risk distribution, data sensitivity, owners, control coverage, review schedule and vendor concentration.
Basis: NIST AI RMF GOVERN 1, MAP 1-2; ISO/IEC 42001 A.4; EU AI Act Art. 26
AI system card
System documentation · one system
Model / AI system card: intended and out-of-scope uses, model and data, evaluation, limitations, oversight, monitoring and change log.
Basis: ISO/IEC 42001 A.6.2.7, A.8.2; NIST AI RMF MAP 2-3, MEASURE 2; EU AI Act Art. 26
Third-party AI vendor assessment
Third-party risk · one system
Due-diligence assessment of an AI vendor across all its services in use: criticality, evidence requests, contract clauses and monitoring.
Basis: ISO/IEC 42001 A.10; NIST AI RMF GOVERN 6, MANAGE 3; EU AI Act Art. 26

Specification

Inventory fields

Identity: Name, vendor, description, category and AI capability.
Accountability: Owner, department, status and review cadence.
Use: Usage context, people affected, number of users, and observed usage from sensors.
Data: Data sensitivity classification: public, internal, confidential or restricted.
Controls: Human oversight, bias monitoring, audit trail and data governance, with open control gaps listed.
Risk: Risk tier and score, with history. Changes are written to the audit log.
Plans: Included in every plan. See pricing.

FAQ

Questions

What counts as an AI system for the inventory?: Anything where AI makes or shapes an output your organization relies on: third-party assistants, AI features inside other products, models you build, and APIs your code calls. If in doubt, record it; a short entry marked minimal risk costs little.
Can we import an existing spreadsheet?: Records can be created by hand or from discovery findings today. If you have a large existing register, talk to us and we will help you load it.
Who can change a record?: Owners, admins and compliance managers manage the inventory. Viewers have read-only access, enforced by the server. Every change is in the audit log with the person and the time.

See what is in use before you decide anything.

Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.

Start 14-day trial Talk to us See pricing