FIELD GUIDE

Discovery & AI inventory

The inventory is the factual foundation for role mapping, classification, evidence requests and remediation. Do not begin by scoring risk before you understand the use case.

Minimum inventory record

System/use-case name and plain-English description

Intended purpose and decisions or content influenced

Business owner, technical owner and day-to-day users

Vendor/provider, model or upstream AI dependency

Who is affected, including employees, customers or vulnerable groups

Data inputs/outputs and indicators of personal or sensitive data

Countries where the system is offered, deployed or its outputs are used

Lifecycle status, system/model version and material change history

Role hypothesis: provider, deployer, importer, distributor or other relevant role

Evidence links, open questions, last review date and next review trigger

Ten discovery questions

1.What does this system actually do, in one sentence?
2.What decision, recommendation, ranking, prediction or content does it produce?
3.Who decided to use it and for what intended purpose?
4.Who built/provides it and whose name or trademark is on the final system?
5.Who uses the output and how much influence does the output have?
6.Who can be affected by a wrong, biased or misleading output?
7.What data goes in, and where did the data/model come from?
8.Has the purpose, model, data or feature set changed since approval?
9.What monitoring, review and escalation happens after deployment?
10.What evidence exists for each important statement we have just been told?

Shadow AI discovery

The uploaded lesson pack emphasises that official records can be a ‘miasma map’: neat but incomplete. Use multiple discovery channels rather than relying on the approved software list.

✓Interview teams about what they actually use, including browser tools and personal/department subscriptions.
✓Review procurement and expense-card records for low-value SaaS and AI subscriptions that bypassed central IT.
✓Look at API and SSO/application telemetry where appropriate and authorised.
✓Review vendor release notes and existing SaaS products for newly introduced AI features.
✓Ask about spreadsheets, scripts, copilots and AI functions embedded inside tools already considered ‘approved’.
✓Prioritise HR, finance, customer eligibility, healthcare, security, safety and other higher-consequence functions.

What good looks like

Another consultant can read the inventory record and understand the system, purpose, people, data, supplier, geography, owners, version and evidence without needing the original workshop facilitator in the room.