Why AI Governance Begins With a Decision Inventory

Many governance efforts open with a policy document. The more durable approach opens with a question: where, today, does AI influence a decision that affects a person, a budget or a legal obligation? Without that answer, policy addresses an imagined organization rather than the actual one.

What a decision inventory contains

• The decision supported, and the business owner accountable for it.

• The AI capability involved, including tools adopted informally by staff.

• The data used, with its sensitivity classification.

• The degree of human review before the output takes effect.

• The population affected, and the consequence of an erroneous output.

From inventory to proportionate controls

Once decisions are listed, they can be tiered by consequence. Low consequence uses receive light controls such as acceptable use guidance and logging. High consequence uses receive documented risk assessment, defined human oversight, testing before deployment, and periodic review. Proportionality keeps governance credible with the staff who must follow it.

Alignment with recognized frameworks

The inventory maps naturally to the NIST AI Risk Management Framework (AI RMF 1.0), whose Govern, Map, Measure and Manage functions presuppose that the organization knows its systems and contexts. Organizations in regulated or public sectors should also confirm which sector specific requirements apply; that determination belongs with qualified counsel and compliance staff.

Candid risks

• Inventories decay quickly; assign an owner and a review cadence at the outset.

• Shadow use is under reported when staff fear penalty. Pair the inventory with a clear, non punitive disclosure path.

• A tiering model that is too elaborate will not be maintained.

What to do next

Ask each department head to list three decisions in which AI tools now play a part, formal or informal. Consolidating those lists typically reveals the first governance priorities. To discuss the process, submit a consultation request on the Get Started page.