AI Asset Inventory
A complete register of every AI system the organization uses — what it does, who is responsible, what risk level it carries, and when it is due for review.
Every AI system in use across the organization is listed here — with its risk level, current status, owner, and next scheduled review date. High-risk systems are flagged and require formal sign-off before going live.
AI System Register
Showing 6 systems
| System ID | System Name & Dept | Purpose & AI Tasks | Risk Tier | Lifecycle Status | Verified | Next Review | Actions |
|---|
Accountability & Veto
Who is responsible for each AI system, who has the authority to stop a deployment, and how human oversight is maintained throughout the AI lifecycle.
Shows who is responsible for every AI-related decision — and who has the right to block a system from going live. Seven roles carry formal veto power. This ensures no AI system can be deployed without proper sign-off from Legal, Risk, Ethics, and senior leadership.
NIST AI RMF Governance & Lifecycle RACI Matrix
Showing 28 lifecycle activities
Human-AI Configuration Register (GOVERN 3.2)
Mandatory oversight definitions, human roles in output, and override authorities per registered system.
| System ID | System Name | Configuration Level | Human Role in Output | Override Authority | Mandatory Review Triggers |
|---|
Mandatory AI Governance Training Completion Tracker (GOVERN 2.2)
Tracks personnel training across NIST AI RMF core risk domains.
| Staff Member | Governance Role | AI Ethics | NIST RMF | Bias/Fairness | AI Security | Incident Resp. | Policy |
|---|
Release Gates & Policy
Four mandatory checkpoints that every AI system must pass before it is allowed to go live. Also covers the organization's core AI principles, required documentation, and how exceptions are managed.
Before any AI system can go live, it must clear four formal gates — covering data handling, safety testing, ethical review, and legal sign-off. This section shows the status of those gates for each system, the supporting documentation required, and any active policy exceptions.
When a System Must Be Switched Off
Defined conditions that require an AI system to be immediately suspended, handed back to human operators, or fully retired.
| ID | Decommissioning Trigger | Operational Threshold / Trigger Condition | Mandatory Response Action |
|---|
NIST AI RMF Trustworthy AI Principles Verification (GOVERN 1.2)
8 foundational organizational principles with active operational standards and verification criteria.
| ID | Principle & Ref | Policy Statement | Operational Standard & Verification | Status |
|---|
Mandatory Lifecycle Documentation Standards (GOVERN 1.4)
Readiness and compliance status of the 9 required audit artifacts across the AI system lifecycle.
| Doc ID | Mandatory Artifact Name | Lifecycle Stage | Accountable Role | Artifact Purpose & Retention | Readiness Status |
|---|
Third-Party AI & Supply Chain Due Diligence (GOVERN 6.1 & 6.2)
Mandatory vetting criteria for foundation models, commercial APIs, and external ML vendor integrations.
| Item | Vetting Dimension | Weight | Mandatory Contractual & Technical Requirement | NIST AI RMF Ref |
|---|
Formal Policy Deviations & Risk Waiver Register (GOVERN 1.1)
Time-bound approved exceptions with mandatory compensating controls and executive sign-off.
| Waiver ID | System Name | Clause Affected | Nature of Exception & Compensating Controls | Expiry Date | Approved By |
|---|
Harm & Risk Profiles
13 identified failure scenarios showing what could go wrong with each AI system — the likelihood, the potential harm, and the protections in place. Also covers approved uses, prohibited uses, and safeguards for vulnerable groups.
For each AI system, this section maps out 13 specific ways it could cause harm — ranked by likelihood and severity. It also records what the system is allowed and not allowed to do, and what extra care has been taken for groups who may be more affected.
NIST AI RMF Risk vs. Benefit Scoring Matrix (MAP 3.1 & 3.2)
Balancing operational utility and financial inclusion against pre- and post-mitigation risk scores.
| ID | Category | Risk & MAP Subcategory | Pre-Risk | Control Description & Treatment | Residual Risk | Monitoring & Frequency |
|---|
Disproportionately Affected & Vulnerable Populations (MAP 5.2)
Specific risks, required safeguards, and verified protective measures for vulnerable customer cohorts.
| Vulnerable Cohort | Vulnerability Basis | Specific Risks from AI | Mandatory Protective Safeguards | Status |
|---|
Stakeholder Identification & Engagement Register (MAP 1.2 & MAP 5.1)
20 key internal and external actors categorized by Power-Interest quadrant and engagement feedback mechanisms.
| ID | Stakeholder Name | Category | Priority | Power-Interest | Engagement Channel & Feedback Loop |
|---|
Intended Uses & Operational Envelopes
Foreseeable Misuse & Guardrails
Strictly Unacceptable Uses
6-Layer Human Oversight Architecture (MAP 3.5 & GOVERN 3.2)
Defense-in-depth human-AI operational interaction boundaries and auto-escalation pathways.
| Oversight Layer | Operational Description & Escalation Trigger | Execution Cadence |
|---|
Third-Party AI & Cloud Infrastructure Dependencies (MAP 4.1)
Supply chain risk assessment covering inference APIs, vector search, pre-trained weights, and edge transit.
| ID | Component & Provider | Component Type | Risk Level | Data Residency | Data Retention SLA | Status |
|---|
Quality & Safety Checks
Objective measurement of whether each AI system is performing as intended — covering accuracy, safety, and fairness across 20 defined thresholds. Includes pre-deployment testing and ongoing monitoring.
This section answers the question: "Is the AI system actually working as it should?" It tracks 20 measurable performance and safety thresholds, 11 pre-launch test results, and checks whether the system treats different groups of people fairly.
Production AI Metrics Tracker (MEASURE 1.1 & 2.1)
Tracking all 20 metrics across 4 tiers with explicit formulas, collection cadences, and red-line thresholds.
| ID | Metric Name & Tier | NIST Characteristic | Measurement Formula & Source | Target vs. Red Line | Actual Value | Status | Cadence & Owner |
|---|
Demographic Proxy Dimensions & Operational Testing (MEASURE 2.11 · NIST SP 1270)
Evaluating equity and bias across socio-technical proxy dimensions without collecting direct PII.
| Proxy Dimension | Correlated Demographic Factors | Operational Testing Procedure | Benchmark Disparity & Status |
|---|
Pre-Deployment Bias Test Procedures (FAI-01 to FAI-05)
Empirical accuracy, escalation, tone, and vulnerability stress tests with statistical significance thresholds.
| Test ID | Test Name | Objective & Sample Size | Pass Criteria | Observed Empirical Result & Status |
|---|
Interactive Disparity & Four-Fifths Rule Calculator
Simulate accuracy or pass-rate disparity across reference and focal groups per EEOC 4/5ths rule and NIST SP 1270 criteria.
Real-Time Telemetry & Multi-Audience Dashboards (MEASURE 3.1)
Targeted operational views configured with specific refresh frequencies and telemetry metrics.
| Dashboard View | Target Audience | Monitored Telemetry & Metric IDs | Refresh SLA |
|---|
Incident Alert SLA Tiers & Escalation Boundaries (MEASURE 3.3)
Enforcing deterministic response SLAs when production metrics approach or breach red-line thresholds.
| Alert Severity | Trigger Condition / Breach Threshold | Notification Channels & Accountable Recipients | Response SLA |
|---|
TEVV Pre-Deployment Lifecycle Roadmap (Weeks 1 to 20)
Step-by-step phased testing leading to formal GATE-03 deployment clearance.
| Timeline | TEVV Activity | Test Suites Executed | Lead Role Owner |
|---|---|---|---|
| Weeks 1–2 | Test suite design and test dataset curation | All Suites (TS-01 to TS-11) | TEVV Team Lead |
| Weeks 3–6 | Component unit testing & end-to-end integration flows | TS-02, TS-03, TS-09 | AI/ML Engineering + QA |
| Weeks 7–10 | Safety, adversarial red teaming & privacy testing | TS-04, TS-05, TS-06 | InfoSec + DPO + Red Team |
| Weeks 10–12 | Fairness, demographic proxy & explainability testing | TS-07, TS-08 | AI Ethics Officer + UX |
| Weeks 12–14 | Accuracy benchmarking & stress/load testing | TS-01, TS-10 | TEVV Team + SRE |
| Weeks 15–18 | Customer pilot & user acceptance testing (500+ users) | TS-11 (UAT) | UX Research + CS Lead |
| Weeks 19–20 | TEVV Validation Dossier compilation & GATE-03 Sign-off | Full Framework Audit | AI Risk Officer + CAIO |
GATE-03 TEVV Sign-Off Verification (GOVERN 1.3 · MEASURE 4.2)
Mandatory technical thresholds that must be certified before live production release.
Incident Playbooks & Response
NIST MANAGE Live Controls ActiveStep-by-step response plans for when an AI system causes harm or behaves unexpectedly — with a 15-minute target to contain the situation. Also tracks improvements made after each incident.
When an AI system causes harm or behaves in an unexpected way, this section provides the playbook for responding — containing the situation within 15 minutes, notifying the right people, and making sure the same thing does not happen again.
Audit trail of continuous organizational and algorithmic improvements driven by real-world telemetry, red-teaming, and incident debriefs (MANAGE 3.1, 4.3).
A structured sign-off process combining evidence from all six governance areas into a single board-level decision. Executives and auditors can review the full risk picture for any AI system and formally attest that it has been assessed against the organization's governance standards.