AI Rules Need an Inventory Before a Policy

An AI policy cannot govern systems nobody has identified. Start with an inventory of uses, owners, data, decisions, and evidence.

\n

The first risk is invisibility

\n

Organisations often have more AI use than their central team knows. A vendor feature, a spreadsheet add-on, a support bot, and an internal model may all make decisions or shape human decisions.

\n

An inventory should capture the use, owner, provider, purpose, affected people, inputs, outputs, human role, and evidence retained. It should also mark unknowns rather than filling them with assumptions.

\n

Inventory is not a declaration that every use is equally risky. It is the foundation for deciding which uses need deeper review.

\n

Describe the decision

\n

A model label is less informative than the decision it influences. Ask whether the output ranks, recommends, approves, denies, predicts, drafts, or controls an action.

\n

Name who can challenge the result and what happens after a challenge. Human involvement only matters if the person has time, authority, and enough information to intervene.

\n

Separate administrative convenience from material impact. A low-stakes drafting aid needs a different control path from a system that affects access, safety, or opportunity.

\n

Trace data and provider claims

\n

Record what data enters the system, whether it is retained, how it is used for improvement, and which subcontractors or regions are involved. Vendor documentation may answer some questions and leave others open.

\n

Keep a copy of relevant product terms and technical statements with a date. Providers change models and settings; yesterday’s description may not describe today’s system.

\n

Do not treat a benchmark as a full risk assessment. Performance in a test set does not establish suitability for a particular population or workflow.

\n

Build evidence around use

\n

Evidence should match the decision. Keep evaluation results, known limitations, monitoring signals, incidents, corrections, and approval records that a reviewer can understand.

\n

A policy should state what evidence is required before launch and what evidence is reviewed after launch. Otherwise approval becomes a one-time ceremony.

\n

Set a change trigger. A new model, data source, task, user group, or deployment context may require the review to reopen.

\n

Use risk as a work queue

\n

Risk categories are useful when they change the queue. A higher-consequence use should receive more review, stronger controls, clearer user communication, and more frequent monitoring.

\n

Do not force every system into the same process. Uniform forms can hide the difference between a spelling assistant and a decision system.

\n

Assign an owner who can stop or change the use. A committee that cannot affect deployment is an advisory meeting, not a control.

\n

Legal review and engineering review

\n

Regulation sets obligations that vary by jurisdiction and use. Engineering evidence shows how the system actually behaves. Both are needed, and neither should pretend to replace the other.

\n

When comparing AI platforms, structured technology market intelligence may help organise product categories. The deployment decision still rests on the documented use and evidence.

\n

The practical standard is simple: define the claim, show the evidence, name the uncertainty, and state what decision follows. Technology coverage earns trust when a reader can repeat the check without borrowing the writer’s confidence.

\n

Frequently asked questions

\n

Is an AI inventory only for models built in-house?

\n

No. It should include vendor features, embedded tools, and systems that shape decisions even when the organisation did not train the model.

\n

What should every inventory record contain?

\n

Use, owner, purpose, affected people, data, provider, output, human role, evidence, changes, and open questions.

\n

Does the article provide legal advice?

\n

No. It describes operational preparation. Legal and regulatory interpretation should come from qualified counsel for the relevant use and jurisdiction.

\n

Sources and scope

The European Commission explains the EU regulatory framework for AI and its risk-based approach. This article does not provide legal advice; it describes an operational preparation method. European Commission AI Act overview. Accessed 2026-09-11. This article makes no claim about rankings, revenue, analytics, indexation, or a specific vendor outcome.

\n

Questions for the next review

\n

Before acting on the argument in “AI Rules Need an Inventory Before a Policy”, write down the decision it is meant to support. The decision may concern architecture, procurement, controls, investment, or an operating change. The owner should be able to say what will be different if the evidence is persuasive.

\n

Next, separate what the cited source establishes from what this article infers for a technology team. The source is European Commission AI Act overview; it provides a defined scope, not a universal answer for every company, geography, workload, or customer. Preserve that boundary in any internal briefing.

\n

Use the category label, Artificial Intelligence, as a starting point for the review rather than as a conclusion. Ask which adjacent capability, supplier, data dependency, or workflow could change the result. A narrow definition is usually more useful than a broad claim that cannot be tested.

\n

Then choose one observable measure and one disconfirming signal. The measure shows whether the intended improvement is appearing. The disconfirming signal shows when the assumption is failing. Keeping both prevents a team from collecting only evidence that supports the original plan.

\n

Finally, schedule a review while the decision is still reversible. Record the date, the evidence owner, the assumptions that may change, and the action that follows each outcome. This is how a technology article becomes an operating habit instead of a piece of commentary.

\n

If the evidence is incomplete, label the gap plainly and assign the smallest next check that can close it. A bounded unknown is manageable. An unknown hidden inside a confident recommendation is not.

\n

A final review should ask whether the recommended action is still proportionate. New evidence may reduce the risk, raise the risk, or show that a different control is better. The record should make all three outcomes possible.