Free template · Inventory · Version 1.0 · October 2026
You can’t govern AI you don’t know exists. This free Excel template helps you find every AI tool, feature, and model your organization uses, record who owns it and what data it touches, and see at a glance which systems need a closer look.
It’s the first deliverable in my 8-step AI governance program, and it’s built for security, risk, and compliance teams who need something practical this week, not a platform project next quarter.
AI System Inventory Template
- Excel workbook, 5 tabs
- Risk tier calculated automatically
- Shadow AI discovery checklist
- Leadership dashboard
What’s inside
How to use the template in six steps, and how it maps to NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
One row per AI system: use case, owners, users, data, approval status. Dropdowns where it matters.
Where to look for shadow AI: expenses, SSO logs, browser extensions, vendor features, and more.
What makes a system High, Medium, or Low, and what each tier requires before approval.
Totals that update automatically: systems by tier, customer-facing AI, unapproved tools.
How to use it in your first week
- Find the AI. Work through the Discovery Checklist. Don’t rely on self-reporting alone: check expense reports, SSO and web traffic logs, browser extensions, and AI features vendors have switched on inside tools you already own.
- Log each system. One row per tool, feature, or model. Record what it does, who owns it, who uses it, and what data it touches.
- Let the tier guide you. The template assigns High, Medium, or Low from your answers. High-tier systems need a full AI risk assessment before approval.
- Report it. Share the Dashboard with leadership or your AI governance committee. “How many AI systems do we have?” is the first question they’ll ask.
How the risk tier is assigned
| Tier | Assigned when (any of) | Review |
|---|---|---|
| High | Affects decisions about people (hiring, credit, health, access to services), uses personal or sensitive data, or is customer-facing | Every 6 months |
| Medium | Uses confidential internal data, but no sensitive data, not customer-facing, and no decisions about people | Annually |
| Low | Productivity use with no sensitive or confidential data | Annually |
A spreadsheet is a perfectly good place to start. What matters is knowing what’s actually being used across your organization. You can move to a GRC platform later, once you know what you’re tracking.
Watch: 8 steps to build an AI governance program
The inventory is step 3 of 8. The full video walks through every step, from objectives and ownership to laws, risk tiers, policies, training, and monitoring, with a deliverable for each one.
Want to know where your organization stands?
Once your inventory is started, the next question is how mature the rest of your program is. Take the free AI governance assessment, or book a call and I’ll walk through your inventory with you.
Take the free assessment Book a free 30-minute callGeneral guidance, not legal advice. Have counsel review the legal requirements that apply to your organization.