Home · Synthesis · cl-ai-resource-inventory

AI resource inventory — data, tooling, systems, people across AI lifecycle

EU AI ActISO 42001CERT-InNIST AI RMF

Primary statement

AI resource inventory per ISO 42001 A.4.2 + Clauses 5 + 7 + EU AI Act Article 17 QMS + CERT-In + NIST AI RMF GOVERN-1.6. The inventory is the operational foundation for AI governance — without it, governance is theoretical.

Audit-fatigue payoff

A unified AI resource inventory — data + tooling + systems + people across the AI lifecycle — satisfies inventory requirements across all 4 contributing frameworks. ISO 42001 A.4.2 is the audit-defensible specification.

Strictness matrix

Scope
Scope: inventory of resources AI systems rely on at EACH lifecycle stage — data, tooling, systems, people. Lifecycle-wide scope. Ceiling source: iso42001:A.4.2 Rationale: ISO 42001 A.4.2 lifecycle-wide scope is comprehensive.
Threshold
Threshold: build AND maintain inventory. Maintenance is binary — stale inventories fail. Ceiling source: iso42001:A.4.2 Rationale: ISO 42001 A.4.2 maintenance threshold is the audit-defensible qualifier.
Method
Method: inventory schema covering data + tooling + systems + people + per-system lifecycle stage + integration with NIST GOVERN-1.6 AI inventory + EU AI Act Art 17 QMS resources + leadership oversight (Cl.5) + resource allocation (Cl.7). Ceiling source: iso42001:A.4.2 Rationale: ISO 42001 A.4.2 + NIST GOVERN-1.6 + EU AI Act Art 17 combined are the most prescriptive.
Frequency
Inventory refresh: continuous through change management + annual completeness review. Ceiling source: iso42001:A.4.2 Rationale: Annual review with continuous refresh is the cadence.
Evidence
Evidence: AI resource inventory with all schema fields populated + per-system lifecycle stage mapping + change management integration. Ceiling source: iso42001:A.4.2 Rationale: ISO 42001 A.4.2 evidence is the audit-defensible specification.

Auditor test pattern

Step 1: Inspect AI resource inventory. Step 2: Verify coverage across data + tooling + systems + people. Step 3: Sample 3 AI systems; verify lifecycle stage mapping. Step 4: Verify change management integration.

Common findings

Common findings: (1) Inventory covers AI systems but not data sources; (2) Lifecycle stage mapping absent; (3) Stale inventory; (4) People dimension excluded.