An inventory can reveal where AI is being used, but a list of product names is not enough. Each entry should explain the purpose, affected people and the person responsible for deciding whether use should continue.
A practical example
A customer-support team may use one tool for drafting replies and another for assigning priority. Record those uses separately. The first changes language; the second can change which customer receives attention. Their review needs and failure consequences are different.
What to check
- Record intended use and explicitly excluded uses for each system.
- Name the owner who reviews incidents and approves material changes.
- Keep evidence of evaluation and a route for affected people to raise concerns.
The trade-off
Governance works best when it supports real decisions. A long checklist that nobody revisits after procurement provides less assurance than a smaller set of controls with clear ownership and review dates.
Research context
NIST’s AI Risk Management Framework organizes voluntary risk-management activities across the AI lifecycle. It offers a shared vocabulary for governance, rather than declaring any individual deployment risk-free.
Read the original reference material. The practical examples and evaluation questions above are TheTechGlow’s editorial application of the topic, not reported results from a product test.
Explore Responsible Artificial Intelligence for topic coverage, or continue to Artificial Intelligence & Automation for the wider sector.
References and further reading
- nist.govhttps://www.nist.gov/itl/ai-risk-management-framework
