AI System Inventory

Expanded Definition

An AI system inventory is the governed source of truth for every AI system in scope, including ownership, business purpose, data classes, model type, deployment context, and assigned risk tier. Unlike a simple application register, it is meant to support policy enforcement, evidence retention, and control scoping across the full lifecycle of AI use. In NHI security practice, the inventory also helps determine where machine identities, secrets, and automated access paths are created or inherited by an AI system.

Definitions vary across vendors on whether the inventory should include shadow AI, embedded third-party models, or only systems that are formally approved. NHI Management Group treats the operational baseline as broader than procurement records but narrower than general software discovery: if a system can process data, make decisions, or invoke tools, it belongs in the inventory. That aligns well with governance models such as NIST Cybersecurity Framework 2.0, which expects organisations to know what assets exist before they can protect or monitor them.

The most common misapplication is treating the inventory as a one-time procurement list, which occurs when teams fail to update it after model swaps, new integrations, or changes in tool access.

Examples and Use Cases

Implementing an AI system inventory rigorously often introduces reporting overhead, requiring organisations to weigh governance precision against the cost of continuous updates and ownership validation.

• A customer support chatbot is recorded with its business owner, training data sources, customer data exposure, and whether it can call ticketing tools through an agentic workflow.
• A finance team’s document summarisation model is entered into the register so compliance can confirm retention rules, approved datasets, and whether the model touches regulated records.
• A third-party copiloting feature is tracked even when embedded in another SaaS product, because the organisation still needs to know what data leaves its boundary and under which terms.
• After a secret leakage event, the inventory is used to identify every AI system that may have inherited the exposed credential path, supporting incident scoping and rotation priorities. The urgency of that linkage is underscored by the State of Secrets in AppSec research, which shows that leaked secret remediation still averages 27 days.
• When a model is retrained or replaced, the inventory is updated so auditors can trace which version was active, what data it saw, and which approvals were valid at the time.

For systems that expose tools or rely on federated identities, inventory entries should also reference the operational identity boundary, not just the model name. That becomes especially important in relation to LLMjacking: How Attackers Hijack AI Using Compromised NHIs, where abused credentials turn a benign AI deployment into an attack surface.

Why It Matters in NHI Security

An AI system inventory is a prerequisite for deciding which machine identities exist, where secrets are stored, and which systems are allowed to act autonomously. Without it, access reviews become incomplete, incident response misses hidden dependencies, and decommissioning leaves behind orphaned credentials. That creates a direct NHI risk because untracked AI systems often retain service accounts, API keys, certificates, or delegated access long after the business owner thinks the project ended.

The inventory also supports evidence retention when regulators or auditors ask why a system was approved, what controls applied, and whether the deployment changed over time. In practice, inventory quality determines whether teams can separate experimental AI from production AI, and whether they can apply the right obligations to each. The consequence is not just poor hygiene, but lost control over the identities that let AI systems read, write, and execute.

Organisations typically encounter the need for an AI system inventory only after an outage, credential exposure, or audit finding reveals that no one can reliably name every AI system still in production.

Related resources from NHI Mgmt Group

• Asset Inventory
• Secrets Inventory
• When should organisations treat an AI agent as a privileged system?
• What is the difference between AI discovery and AI inventory?