AI System Inventory, Scope, and Lifecycle Classification

A model registry tracks artifacts. An AI system inventory tracks operational use. An asset scan finds only what leaves a technical fingerprint.

The middle column is not a thought experiment. One instance of it can be downloaded. Federal agencies run a public inventory of their own AI uses, and the rule behind it is blunt: “Federal agencies, with limited exceptions, are required to conduct annual inventories of their AI use cases and make this information publicly available.” That line is the README of the consolidated 2024 Federal Agency AI Use Case Inventory. The Office of Management and Budget maintains it under Executive Order 13960, the Advancing American AI Act and OMB Memorandum M-24-10. As of 23 January 2025 it reported 41 agency submissions and 2,133 AI use cases. Of those, 351 were flagged rights-impacting and/or safety-impacting — 145 at the Department of Veterans Affairs, 124 at the Department of Justice. FedScoop counted 37 agencies and 1,757 use cases at the December 2024 release, against 710 in the 2023 consolidated list.

Notice what the unit is. Not a model file and not a version tag, but a use: an agency, a purpose, and a flag saying whether the thing touches people's rights or their safety. A model registry counts artifacts. It would never have produced the number 351, because impact is not a property of a checkpoint. An asset scan would have found call paths and repositories. It could not have said which of the 2,133 uses were the consequential ones. The unit a register counts in decides what the register is able to notice.

An AI inventory is a living control surface, not a list of model files. It identifies systems by function and impact, connects components to real uses, and keeps ownership attached from experimentation through retirement. Records usually begin with what the system is for and whom it touches: purpose, affected population, decision role, autonomy. Then what it is made of: data categories, model and vendor, deployment locations. Then who answers for it: users, owner, risk tier, approvals. Then what has happened to it since: dependencies, monitoring, incidents, lifecycle state. Discovery has to reach embedded, purchased, rule-based and generative components wherever they influence consequential outcomes.

This is not only good practice. It is a named and numbered control. Inventory sits inside the GOVERN function of the NIST AI Risk Management Framework, published in 2023: “GOVERN 1.6: Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.” The resourcing clause is the half that gets dropped. An inventory is not free, and the framework ties the effort spent on it to the risk priorities of the organisation. Which presupposes that the register carries a risk tier in the first place.

What happens when the requirement exists and the rows do not carry their weight has been measured. In December 2023 the U.S. Government Accountability Office looked at 23 civilian CFO Act agencies. Twenty of them reported about 1,200 current and planned AI use cases. “Specifically, five agencies provided comprehensive information for each of their reported use cases while the other 15 had instances of incomplete and inaccurate data.” Mandatory, government-wide, public — and still 15 registers with incomplete and inaccurate rows in them. GAO made 35 recommendations to 19 agencies.

Run the discovery rule against anything a vendor labeled analytics rather than AI. That label is what keeps consequential systems off the register.

Experiment, pilot, production, restricted, retired: the state a system sits in decides what evidence is owed for it.

Those states are not evenly populated, and one government has counted its own. In 2024 the Netherlands Court of Audit asked 70 central government organisations what AI they were running. Between them they named 433 systems. At the time of the investigation 167 were ongoing experiments, 120 (28%) were actually in use, 141 had been terminated and 5 were of unknown status.

Read that against the five states below. The largest state is experiment. The second largest is terminated. Most of what a register holds is not the thing people picture when they say “our AI systems”. Governance designed only for production would have covered 120 of the 433. And the 5 of unknown status are the honest ones. An organisation that cannot say which state a system is in has said something true about its own evidence.

Seventy central government organisations were asked what AI they were running. They named 433 systems. The Netherlands Court of Audit then held that list against the public Algorithm Register the same government maintains. “Only 22 (5%) of the 433 reported systems have been entered in the Algorithm Register.”

Nothing here was hidden by a vendor or buried in a spreadsheet plug-in. The organisations knew what they had and said so when asked. The register simply was not the place where that knowledge lived.

Expense records and browser extensions surface more shadow AI than any survey does. The retirement drill is the one most organizations skip. It is also the one the framework names in its own right. Beside the inventory subcategory sits a second one: “GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness.” Read the clause carefully. Switching a system off is itself a change, and a change can increase risk. Retirement is something an organisation has to be able to show it did safely. Not merely something it stopped doing.

Inclusion rules come before discovery. A search that starts from the word “AI” finds only the systems that were marketed that way.

The EU AI Act turns that principle into a documented obligation, and the mechanism is worth copying whatever jurisdiction you sit in. Article 6(3) lets a provider treat a system listed in Annex III as not high-risk in four narrow cases only, and never where the system performs profiling of natural persons. Article 6(4) then closes the exit: “A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service.” That documentation must go to national competent authorities on request. And Article 49(2) requires the provider to register itself and the system in the EU database under Article 71 anyway.

So the claimed exemption does not remove the system from the record. It becomes a written, dated, attributable judgement inside the record. A label such as “analytics rather than AI” is never made to be any of those three things.

The five steps below put that discipline in order: rules first, then discovery, then enrichment, then the change events that trigger review, then reconciliation and retirement.

An inventory nobody reconciles against real usage decays into a list of things that were true once. That is not a warning about a hypothetical organisation. The Dutch survey found 141 of 433 reported systems already terminated and 5 of unknown status. GAO found agency inventories that omitted the AI life cycle stage altogether, so the register could not answer the question this section asks.

Say which evidence moves a record into the restricted state. And which evidence retires it. For the second, GOVERN 1.7 has already set the bar: decommissioning and phasing out has to be done in a way that does not increase risks or decrease trustworthiness. A retirement entry owes proof of what stopped. Not a change of status word.