AI System Inventory & Registry
Centralized organizational registry tracking model types, risk tiers, third-party components, hosting models, data classifications, TEVV verification, and review cadences.
Enterprise AI System Inventory Registry
Showing 6 systems
| System ID | System Name & Dept | Purpose & AI Tasks | Risk Tier | Lifecycle Status | TEVV Status | Next Review | Actions |
|---|
AI Roles & Responsibilities Matrix
Operational governance RACI matrix, role hierarchy, veto authorities, human-AI oversight configuration register, and mandatory personnel training tracker.
NIST AI RMF Governance & Lifecycle RACI Matrix
Showing 28 lifecycle activities
Human-AI Configuration Register (GOVERN 3.2)
Mandatory oversight definitions, human roles in output, and override authorities per registered system.
| System ID | System Name | Configuration Level | Human Role in Output | Override Authority | Mandatory Review Triggers |
|---|
Mandatory AI Governance Training Completion Tracker (GOVERN 2.2)
Tracks personnel training across NIST AI RMF core risk domains.
| Staff Member | Governance Role | AI Ethics | NIST RMF | Bias/Fairness | AI Security | Incident Resp. | Policy |
|---|
AI Governance Policy & Deployment Gatekeeper
Operationalizing organizational AI principles, mandatory 4-tier deployment gates, lifecycle documentation standards, third-party foundation model vetting, and formal exception tracking.
Mandatory Decommissioning Triggers (GOVERN 1.7)
Standard conditions requiring immediate system suspension, fallback to human operators, or complete retirement.
| ID | Decommissioning Trigger | Operational Threshold / Trigger Condition | Mandatory Response Action |
|---|
NIST AI RMF Trustworthy AI Principles Verification (GOVERN 1.2)
8 foundational organizational principles with active operational standards and verification criteria.
| ID | Principle & Ref | Policy Statement | Operational Standard & Verification | Status |
|---|
Mandatory Lifecycle Documentation Standards (GOVERN 1.4)
Readiness and compliance status of the 9 required audit artifacts across the AI system lifecycle.
| Doc ID | Mandatory Artifact Name | Lifecycle Stage | Accountable Role | Artifact Purpose & Retention | Readiness Status |
|---|
Third-Party AI & Supply Chain Due Diligence (GOVERN 6.1 & 6.2)
Mandatory vetting criteria for foundation models, commercial APIs, and external ML vendor integrations.
| Item | Vetting Dimension | Weight | Mandatory Contractual & Technical Requirement | NIST AI RMF Ref |
|---|
Formal Policy Deviations & Risk Waiver Register (GOVERN 1.1)
Time-bound approved exceptions with mandatory compensating controls and executive sign-off.
| Waiver ID | System Name | Clause Affected | Nature of Exception & Compensating Controls | Expiry Date | Approved By |
|---|
Context Profiling, Harms & Stakeholder Studio
Operationalizing the MAP Function across system boundaries, 13 profiled harm scenarios (R-01..R-13), risk-benefit utility balances, and vulnerable group safeguards.
NIST AI RMF Risk vs. Benefit Scoring Matrix (MAP 3.1 & 3.2)
Balancing operational utility and financial inclusion against pre- and post-mitigation risk scores.
| ID | Category | Risk & MAP Subcategory | Pre-Risk | Control Description & Treatment | Residual Risk | Monitoring & Frequency |
|---|
Disproportionately Affected & Vulnerable Populations (MAP 5.2)
Specific risks, required safeguards, and verified protective measures for vulnerable customer cohorts.
| Vulnerable Cohort | Vulnerability Basis | Specific Risks from AI | Mandatory Protective Safeguards | Status |
|---|
Stakeholder Identification & Engagement Register (MAP 1.2 & MAP 5.1)
20 key internal and external actors categorized by Power-Interest quadrant and engagement feedback mechanisms.
| ID | Stakeholder Name | Category | Priority | Power-Interest | Engagement Channel & Feedback Loop |
|---|
Intended Uses & Operational Envelopes
Foreseeable Misuse & Guardrails
Strictly Unacceptable Uses
6-Layer Human Oversight Architecture (MAP 3.5 & GOVERN 3.2)
Defense-in-depth human-AI operational interaction boundaries and auto-escalation pathways.
| Oversight Layer | Operational Description & Escalation Trigger | Execution Cadence |
|---|
Third-Party AI & Cloud Infrastructure Dependencies (MAP 4.1)
Supply chain risk assessment covering inference APIs, vector search, pre-trained weights, and edge transit.
| ID | Component & Provider | Component Type | Risk Level | Data Residency | Data Retention SLA | Status |
|---|
TEVV, Production Metrics & Bias Testing Studio
Operationalizing the MEASURE Function across 20 production metrics (M-01..M-20), 11 pre-deployment test suites (TS-01..TS-11), demographic proxy bias audits, and real-time monitoring SLAs.
Production AI Metrics Tracker (MEASURE 1.1 & 2.1)
Tracking all 20 metrics across 4 tiers with explicit formulas, collection cadences, and red-line thresholds.
| ID | Metric Name & Tier | NIST Characteristic | Measurement Formula & Source | Target vs. Red Line | Actual Value | Status | Cadence & Owner |
|---|
Demographic Proxy Dimensions & Operational Testing (MEASURE 2.11 · NIST SP 1270)
Evaluating equity and bias across socio-technical proxy dimensions without collecting direct PII.
| Proxy Dimension | Correlated Demographic Factors | Operational Testing Procedure | Benchmark Disparity & Status |
|---|
Pre-Deployment Bias Test Procedures (FAI-01 to FAI-05)
Empirical accuracy, escalation, tone, and vulnerability stress tests with statistical significance thresholds.
| Test ID | Test Name | Objective & Sample Size | Pass Criteria | Observed Empirical Result & Status |
|---|
Interactive Disparity & Four-Fifths Rule Calculator
Simulate accuracy or pass-rate disparity across reference and focal groups per EEOC 4/5ths rule and NIST SP 1270 criteria.
Real-Time Telemetry & Multi-Audience Dashboards (MEASURE 3.1)
Targeted operational views configured with specific refresh frequencies and telemetry metrics.
| Dashboard View | Target Audience | Monitored Telemetry & Metric IDs | Refresh SLA |
|---|
Incident Alert SLA Tiers & Escalation Boundaries (MEASURE 3.3)
Enforcing deterministic response SLAs when production metrics approach or breach red-line thresholds.
| Alert Severity | Trigger Condition / Breach Threshold | Notification Channels & Accountable Recipients | Response SLA |
|---|
TEVV Pre-Deployment Lifecycle Roadmap (Weeks 1 to 20)
Step-by-step phased testing leading to formal GATE-03 deployment clearance.
| Timeline | TEVV Activity | Test Suites Executed | Lead Role Owner |
|---|---|---|---|
| Weeks 1–2 | Test suite design and test dataset curation | All Suites (TS-01 to TS-11) | TEVV Team Lead |
| Weeks 3–6 | Component unit testing & end-to-end integration flows | TS-02, TS-03, TS-09 | AI/ML Engineering + QA |
| Weeks 7–10 | Safety, adversarial red teaming & privacy testing | TS-04, TS-05, TS-06 | InfoSec + DPO + Red Team |
| Weeks 10–12 | Fairness, demographic proxy & explainability testing | TS-07, TS-08 | AI Ethics Officer + UX |
| Weeks 12–14 | Accuracy benchmarking & stress/load testing | TS-01, TS-10 | TEVV Team + SRE |
| Weeks 15–18 | Customer pilot & user acceptance testing (500+ users) | TS-11 (UAT) | UX Research + CS Lead |
| Weeks 19–20 | TEVV Validation Dossier compilation & GATE-03 Sign-off | Full Framework Audit | AI Risk Officer + CAIO |
GATE-03 TEVV Sign-Off Verification (GOVERN 1.3 · MEASURE 4.2)
Mandatory technical thresholds that must be certified before live production release.
AI Risk & Incident Management (MANAGE 1–4)
NIST AI 100-1 MANAGE Studio Production Live ControlsContinuous risk treatment, rapid incident containment (<15 min SLA), automated circuit breakers, playbook-driven response, and post-incident continuous improvement tracking across all registered AI assets.
Audit trail of continuous organizational and algorithmic improvements driven by real-world telemetry, red-teaming, and incident debriefs (MANAGE 3.1, 4.3).