How to Build an AI Inventory for a Financial Services Firm

Ask a financial firm where it uses AI, and most can produce a list. In the IAA, ACA Group, and YCC survey, 86% of 411 US adviser firms said they keep an inventory of AI tools. In the UK, the Bank of England and FCA found 68% of firms keep a central AI inventory, rising to 92% when partial lists are included.

An AI model inventory goes further than a list of tools. It shows what each system does, who owns it, what data it uses, which customer decisions it influences, and how risky it is. It also includes the AI that arrived inside software you bought for something else.

This guide shows lenders, insurers, and advisers how to build one in six steps, which fields to record, and how to keep it current. It's the foundation of AI model governance in finance. For the wider picture, see our guide to AI governance in financial services.

Why an AI Model Inventory Comes First

Every other AI control depends on the inventory. You can't tier risk, approve deployments, test outputs, monitor drift, or send the notices new state laws require for AI you don't know about. State examiners using the CSBS AI Supervisory Framework ask "who is responsible for oversight" of each AI use, and their document requests include the inventory, owners, risk tiers, and change records.

In July 2025, Massachusetts reached a $2.5 million settlement with student lender Earnest Operations. The Attorney General alleged the company used algorithmic models for lending decisions without testing them for disparate impact. That kind of testing depends on knowing which models make which decisions.

What Counts as AI in Your Inventory

Cast the net wider than your model risk inventory. Elevate Consult groups AI into three categories.

Built: Models your teams developed, such as a credit, fraud, or claims triage model.

Bought: Tools sold to you as AI, such as a vendor chatbot or underwriting engine.

Embedded: AI features added to software you already use, such as a drafting assistant in your CRM or meeting notes in your video platform.

Elevate Consult finds embedded AI is the category institutions most often miss, and third-party AI is growing. In the UK, third parties now account for 53% of high-materiality AI systems, up from 35% in 2024. From October 2027, Singapore's regulator, MAS, will expect firms to inventory AI in software "which may not be explicitly sold as AI, but contains AI features," according to its final guidelines.

Record the type of AI as well. Traditional models, generative AI, and agents carry different risks and need different controls. Finally, include sanctioned employee tools, such as a licensed GenAI assistant, and log the unsanctioned ones you find.

How to Build an AI Inventory in Six Steps

1. Name an Owner and Set the Scope

Give one person responsibility for the inventory itself, usually in second-line risk or the AI governance function. Agree what counts as AI for your firm, using the three categories above, and which business lines and legal entities are in scope.

2. Start from What You Already Have

Pull from the model risk inventory, the third-party risk register, procurement contracts, the data catalog, and any ML model registry. Each one holds part of the picture.

3. Run a Data Call Across the Business

Ask every business line and function what AI they use, built, bought, or embedded, and what it's used for. Keep the form short and give examples, because people don't always recognize a vendor feature as AI.

4. Find the AI Nobody Reported

Check vendor release notes for the platforms with the most users or the closest access to customer data. Elevate Consult calls them "the highest-yield source for embedded AI." Review network traffic to AI services, browser extensions, and expense and corporate card records to find unsanctioned tools.

5. Record Each Entry

Use the fields in the next section. Start with the must-have fields for every entry, and add the rest for high-risk systems first.

6. Confirm Owners, Tier the Risk, and Set Review Triggers

Ask each named owner to confirm their entries, assign a risk tier, and agree what will trigger an update. Expect steps 3 and 4 to take the most time.

The Fields Every AI Inventory Entry Needs

These 12 fields draw on what US examiners and state laws ask for, and on the detailed field list in Singapore's MAS guidelines. Fields marked ★ are the five that matter most.

Record the Customer Decisions Each Tool Influences

The new state laws focus on decisions, which most inventories don't record. Colorado's SB 26-189 covers AI that "materially influences" consequential decisions, including financial or lending services and insurance. California's ADMT rules cover AI that replaces or substantially replaces human decision-making in significant decisions. Both take effect on January 1, 2027. You can't tell which laws apply until you know which decisions each tool touches.

Add a simple decision view alongside the tool list. Give each customer decision type its own row, such as a loan approval, a claims payout, or a portfolio rebalancing recommendation, and link it to the tools that influence it and the data they use. For more on what these laws require, see our guide to the Colorado AI Act and California ADMT rules.

Connect the Inventory to Systems You Already Have

An inventory built from a one-off data call starts going out of date as soon as something changes. Feeding it from systems that already track change keeps it current.

• Procurement and contracts. Add an AI question to vendor intake, so new AI arrives with an inventory entry.
• Third-party risk. Add an AI feature check to vendor reassessments.
• ML model registry. Sync new model versions and retirements automatically.
• Data catalog. Link each entry to the data it uses, so a change in a data source flags the systems that depend on it.

Mukul Juneja, Founding Partner & CTO, Muoro.

Keep the AI Inventory Current and Exam-Ready

Update an entry whenever something changes, such as a new use, a model or vendor update, a new data source, or a retirement. Then review the whole inventory at least quarterly, with each owner confirming their entries.

Keep the records examiners ask for in one place. That means the inventory itself, the named owners, the risk tiers, and a log of changes. For who should sign off at each stage, see our AI governance checklist. For generative AI entries, link the test results described in our guide to how to test generative AI outputs.

Common AI Inventory Mistakes

• A tool list with no decisions: Without decisions, you can't tell which state laws apply.
• Missing embedded AI: As Elevate Consult notes, "Institutions do not usually fail at this by skipping the inventory." More often, they miss the AI that vendors switch on inside existing software.
• No named owner: A committee can review an entry, but someone has to answer for it.
• Two lists that don't match: Keep the AI inventory linked to the model risk inventory instead of running them separately.
• Built once, never updated: Without review triggers and owners who confirm their entries, the inventory drifts out of date.

Build an AI Inventory Examiners Can Rely On

Not sure how complete your AI inventory is? Muoro's AI governance assessment maps the AI you've built, bought, and switched on inside other software, records the decisions each one influences, and gives you a prioritized plan to close the gaps. Book your AI governance assessment.

Frequently Asked Questions

What Is an AI Model Inventory?

It's a maintained record of every AI system a firm builds, buys, or uses inside other software. Each entry covers the system's owner, purpose, data, risk tier, status, and the customer decisions it influences.

What's the Difference Between an AI Inventory and a Model Inventory?

A model inventory usually covers the models under model risk management, such as credit and pricing models. An AI inventory is wider. It also includes generative AI, agents, vendor AI features, and employee tools. You can extend your existing model inventory instead of starting a new list, as long as the two stay linked. Singapore's MAS explicitly allows this.

Does an AI Inventory Need to Include Vendor and Embedded AI?

Yes. Vendor and embedded AI often touch customer data and decisions directly, and regulators are moving to cover it. Singapore's MAS explicitly includes AI features in software that isn't sold as AI, and in the UK, third parties account for 53% of high-materiality AI systems.

What Should We Do When a Vendor Adds an AI Feature to Software We Already Use?

Treat it like any other change. Add it to the inventory, assign a risk tier, check what data it uses and what the contract allows, and decide whether to switch it on. Then add vendor release-note reviews to change management, so the next one doesn't arrive unnoticed.

Is an AI Inventory Enough for AI Governance?

Not on its own. It's the starting point, because risk tiering, approvals, testing, monitoring, and state-law notices all depend on it. The next step is a clear approval path with an owner for each stage.

Is a Spreadsheet Enough, or Do We Need a Tool?

A spreadsheet is fine to start with if you have a small number of AI systems. What matters more is how complete your discovery is and whether every entry has a named owner. Move to a dedicated tool or connect the inventory to existing systems once changes become too frequent to track by hand.