This step registers the AI systems in use or planned for use in one list (the AI system inventory), because you can only evaluate and manage the AI you know you use. You receive the AI system list and the scope determination.
AI systems in use (or planned) are registered together with their purpose, AI role, provider, model, input data, the targets affected by the output, and scope of use (LEVEL 1 individual to 4 company-wide). The evaluation type (excluded, simplified, formal) and the scope are also determined.
Together with the inventory and the selected scope (AI role), a draft Statement of Applicability (Rev.0.1) is also prepared with the first-stage applicability decision for the 38 Annex A controls, so that 5 Risk Assessment selects controls on that basis. Centering on the work selected in Step 3, AI systems and tasks in use or planned are registered together with their purpose, AI role, provider, model, input data, the targets affected by the output, and scope of use (LEVEL 1 to 4); the evaluation type (formal, simplified, excluded) and scope are determined using the evaluation criteria you have reviewed, and passed on as input to 5 Risk Assessment, 6 Impact Assessment and 7 Statement of Applicability.
Output
- Excel "AI System Inventory": for each AI system or task, purpose, AI role, provider (group), model, input data, affected targets, main resources, LEVEL (provisional, confirmed), evaluation type, approving body and scope, and the list to pass on to Steps 5, 6 and 7
- AI system inventoryPurpose / role / provider and model / data / affected targets / LEVEL / evaluation type and basis / status
- Scope determinationInclusion and exclusion, and the basis
- Missing information and items to confirm
- Draft Statement of Applicability (Rev.0.1): first-stage applicability decision for the 38 controls (applicable, excluded, under review) with the basis, and matters to confirm to pass on to the risk assessment
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Models under development or deployed: version, training data, development stage, deployment destinations | AI products and services provided: customers, contracts, intended use, limitations, provided version | AI services and tools in use: provider, account, input data, using department |
Next steps
Previous steps: 3 AI System Selection · 1 AI Context Analysis · 10 Documented Information Control · The results of this step feed into: 2 AI Policy, Roles and Objectives · 3 AI System Selection · 5 AI Risk Assessment · 6 AI System Impact Assessment · 8 Verification and Use Approval · 9 Operational Control · 10 Documented Information Control · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring
