AI inventories and impact assessments

0:00 Inventory and impact

You can't govern what you can't see. Every framework in this course, the EU AI Act, NIST and ISO forty-two thousand and one, starts from the same place: knowing which AI systems you have, what they do, and who they affect. In this lesson you'll build a proper AI inventory, find the shadow AI you didn't know about, rate risk quickly and consistently, and choose the right impact assessment for each use case.

0:32 Why inventory first

Why start with an inventory rather than a policy or a risk framework? Because every other control depends on it. You can't classify under the AI Act, answer a client questionnaire, respond to a vendor incident, or scope an ISO management system without knowing what AI you use and where. Teams that skip the inventory end up writing policies for tools they don't know about, and discover their real exposure only when something goes wrong.

1:05 What to record

An inventory entry needs more than a tool name. Record an ID and description, a business owner and a technical owner, the vendor, product, model and version, and the purpose, including uses you forbid. Record who uses it and who's affected, what data goes in, especially personal or special category data, and what comes out: content, advice, or a decision about a person. Add the degree of autonomy and human oversight, the jurisdictions involved, the AI Act role and tier, a risk rating, the controls in place, status, and a review date.

1:45 Analogy: a hospital equipment register

An analogy: an AI inventory is like a hospital's register of medical equipment. Every device has an ID, a location, a responsible department, a service date and a risk class. Before a new device is used on patients, someone checks it's safe for that purpose. If a device is recalled, the hospital knows exactly where every unit is. Your AI inventory gives you the same power: when a vendor has an incident, or a law changes, you can find every affected use within minutes.

2:22 Finding shadow AI

Now the hard part: finding shadow AI. Run a short, non-punitive survey asking which AI tools and features people use for work. Check expense reports and card statements for AI subscriptions. Review single sign-on and app grants, browser extensions and network logs if you have them. And ask the vendors of software you already use which AI features are switched on by default. The goal is visibility, not punishment. If people fear blame, they'll hide tools.

2:55 Quick risk rating

Rate risk with a simple, repeatable scale. Impact from one to four: one is internal and easily fixed; two is client-facing or limited personal data; three affects individuals or uses significant personal data at scale; four has legal effects on people, uses special category data, touches safety, or is a high-risk AI Act use. Likelihood from one to four, based on autonomy, volume and how mature your controls are. Multiply them. Set a rule, for example any score of nine or more, or any impact of four, needs an impact assessment and approval.

3:35 Which assessment?

Which assessment when? An AI system impact assessment, as expected by ISO forty-two thousand and one and guided by forty-two thousand and five, looks at impacts on people and society across the lifecycle. A data protection impact assessment is required under GDPR and similar laws when processing is likely to be high-risk to individuals. A fundamental rights impact assessment under the AI Act applies to certain deployers of high-risk systems. And some local laws require bias audits, like New York City's rule for hiring tools. The smart move is one combined template with add-on modules.

4:16 Worked example: Jeddah lead scoring

Here's a real estate agency in Jeddah planning AI that scores inbound leads for callback priority. Impact two, because it changes who gets a fast callback, not who gets housing or credit. Likelihood three, because routing is automated. Score six, below their threshold. But it profiles people using personal data, so Saudi data protection law applies, and they run a light assessment anyway. They find the model might deprioritize certain neighborhoods, a proxy for income. So they remove postcode, guarantee every lead a response within twenty-four hours, and check callback rates by region each month.

4:57 Three traps

Three traps to avoid. First, inventorying tools instead of use cases. One chat assistant might power five use cases with very different risks. Second, doing an assessment once and never revisiting it when the model, data or market changes. Set reassessment triggers. Third, writing the assessment after launch to justify a decision already made. The assessment should be able to change the design, or it's theatre.

5:26 Example 2: six-person Dubai travel agency

A simpler example. A six-person travel agency in Dubai runs its first inventory. They find four uses: a chat assistant for itinerary drafts, an AI feature in their email tool that writes subject lines, a WhatsApp chatbot answering visa questions, and a transcription tool for client calls. Scores: the drafts and subject lines are ones and twos. The visa chatbot scores higher, because wrong answers could cost clients a trip, so it gets a light assessment, a rule to link to official sources, and a human check on unusual cases.

6:05 Keep it alive

A final practical tip: keep the inventory where people already work, in a shared spreadsheet or your project tool, with fixed columns and a named owner, and make adding an entry part of every new tool request. An inventory that lives in a forgotten document decays within months. One that's part of the approval workflow stays current automatically, because nobody gets a new AI tool approved without creating its entry.

6:35 Watch me do it: full inventory entry

Watch me do it. I convert the register into the full inventory format for one use case: lead scoring. ID: AI zero zero seven. Owners: head of sales for business, CRM admin for technical. Vendor: the CRM's predictive scoring add-on, version from the release notes. Purpose: prioritize inbound leads for callback order. Prohibited uses: pricing, and deciding who gets viewings. Data in: form fields and website behavior, personal data yes, special category no. Jurisdictions: Saudi Arabia and the UAE, so EU AI Act not in scope, reasoning attached. Autonomy: automated routing, humans can override. Now the risk score: impact two, because it affects callback speed, not access to housing or credit. Likelihood three, because routing is automated at volume. Score six, below our threshold of nine. But it profiles people with personal data, so I open the combined assessment template and fill the light version: necessity, stakeholders, risks, and I spot postcode as a proxy for income. Mitigation: remove postcode, guarantee a response within twenty-four hours, check callback rates by region monthly. Review date: March.

7:51 Recap and next step

Recap. Your inventory is the foundation of everything else. Record owners, purpose, data, outputs, autonomy, jurisdictions, tier, risk and controls. Hunt for shadow AI without blame. Rate risk simply and set a threshold for deeper assessment. Use one combined template for AI, data protection and fundamental rights assessments. Your next step: convert your tool list into the YAML inventory format in the lesson text, one entry per use case, and rate each one.