AI INVENTORY & OWNERSHIP
Describe how AI systems are inventoried, owned and reviewed within your organisation.
Current as of July 2026.
A model answer
Every AI system, agent and embedded AI feature is recorded in a central register. Each entry captures the system's purpose, its autonomy level, the categories of data it processes, the populations it affects, model provenance, hosting region, and whether we act as provider or deployer. Each system has a named business owner and a named control owner. The register is reviewed quarterly and on any material change to a system. Last reviewed: [date].
Evidence a buyer expects
The register itself, exportable, with owners named and a review date. A reviewer will ask to see it. If the register exists only as a claim, the answer fails on the first spot-check.
Why weak answers fail
"We track our AI in a spreadsheet" tells the reviewer nothing about ownership, review cadence or completeness — and invites the follow-up question that exposes the gap. The most common failure is omission: an internal AI tool nobody listed surfaces later in a data-flow question, and every prior answer becomes suspect.
What Hael produces
Hael's AI System Register (ISO/IEC 42001 Annex A.7, NIST GOVERN 1.6, SOC 2 CC3.2) — a living, exportable register with owners, review dates and full profiles, generated from the record rather than maintained by hand.
Related questions
Current as of July 2026. General information, not legal advice.
Keep reading
More from the answer library.
CERTIFICATION & FRAMEWORKS
Are you certified to ISO/IEC 42001, or do you have a documented roadmap to certification?
Read answer →
SUPPLY CHAIN & INCIDENTSList your AI sub-processors and describe how you assess them.
Read answer →
OVERSIGHT & CONTROLSWhere does human oversight sit in your AI system, and who holds it?
Read answer →