How an AI inventory supports responsible governance in your firm

Keeping an AI inventory shows who owns each tool, where the risks sit and which policies you need. Here is how to build one and keep it useful.

Ethics & Technology · 17 October 2026 · 6 min read

You cannot govern what you cannot list. Most small businesses now have AI in several places: a chatbot on the website, an assistant drafting emails, a feature inside the accounting software that flags unusual invoices. Few have written down where it sits, who answers for each tool, or what happens when one gets something wrong. So how does maintaining an AI inventory support responsible governance? It gives you the document every other control depends on: a current list of what you use, what it does and who is accountable for it.

How an AI inventory supports responsible governance

The Corporate Business Alliance’s practice note on establishing an AI system inventory calls a maintained inventory the essential foundation for governance. Its reasoning is practical. Once you know which systems exist, what they do and who owns them, you can apply policies, assess risk and aim controls where they matter instead of spreading them thinly over everything.

The government makes the same point in its Generative AI Framework for HM Government, which advises creating and regularly updating an inventory of AI and machine learning systems. The purpose is oversight. Management and stakeholders can see how AI is being used, where the risks lie (bias, data quality and security among them) and whether the organisation is meeting its regulatory obligations. The framework is written for the public sector, but the logic holds just as well in a firm of fifteen people.

Here is what that looks like in practice. A tool that screens CVs carries a very different risk from one that suggests social media captions. Without a list, both get the same light attention, or none at all. With one, you can decide that the CV tool needs a named owner, a human check on every rejection and a direct conversation with the supplier about how it works, while the caption tool needs only a rule against pasting in customer data. The inventory is what lets you be proportionate.

Why so many small firms have a gap to close

The government’s UK Business Data Survey 2026 found that among businesses using AI, 17% had no AI policy in place and only 5% had a formal written AI policy. A policy is hard to write for tools you have not identified, and harder still to enforce.

Use is also spreading. The Office for National Statistics, in its analysis of AI use in UK businesses, reports that self-reported AI use among firms with 10 or more employees rose from about 12% in late 2023 to about 35% by mid-2026. The average number of AI technologies per adopting business rose more modestly, from around 1.4 to around 1.6.

Put those together and the problem is clear. More firms are adopting AI, and many are running more than one tool. Keeping a single tool in your head is feasible. Keeping three or four in your head, spread across sales, HR and finance and bought by different people, is not.

The OECD’s report on SME technology adoption in the United Kingdom names three recurring frictions for small firms: preparing data and workflows to meet governance expectations, choosing trustworthy providers with proportionate assurance, and integrating tools into live operations. An inventory does not remove those frictions on its own, but each of them starts with the same question. Which tools, which workflows and which suppliers are we actually dealing with?

What to record, and who should own it

A spreadsheet is enough. The discipline matters more than the software. For each entry, record:

• the tool and its supplier;
• what it is used for, and which business process it touches;
• one named owner, a person rather than a department;
• what data goes into it, such as customer, staff or financial information;
• what decisions it shapes, and whether a person checks them before they take effect;
• what you will do if it fails or produces something wrong;
• the date you last reviewed the entry.

Record workflows as well as tools. A lead-scoring feature inside your CRM decides who gets a phone call this week. A tool that drafts replies to customer complaints decides what tone your business takes with an angry client. Both belong on the list because of what they influence, not because they look like “AI”.

Finding everything is the hard part. Ask each team lead what they use, including free tools and features that have been switched on inside software you already pay for. Then check subscriptions and expense claims for anything nobody mentioned. Expect surprises. The cost of this exercise is mainly time rather than money, and the first pass is the longest.

Give overall responsibility to one senior person, whether that is the managing director, the operations lead or whoever already handles risk. Shared ownership by a team usually means nobody checks.

Keeping the inventory accurate without creating bureaucracy

Inventories fail in predictable ways. Someone builds one in a burst of enthusiasm, files it and never opens it again. Or it is so detailed that nobody can face updating it. Or staff keep using tools they never declared, because nobody made it easy or safe to do so.

The fixes are simple. Keep entries short. Review the list every quarter. Adopt one firm rule: no new AI tool is bought, trialled with real data or switched on until it has an entry and an owner. Tell staff that declaring a tool is expected and will not be punished, otherwise the list will only show what people are willing to admit.

This also fits the wider direction of travel. Business in the Community’s Responsible AI Framework, which it describes as the UK’s first, sets out core actions on AI ethics, governance and strategy for businesses of all sizes, with governance as the foundation. An inventory is the most practical first piece of that foundation, and it is one a small firm can build without outside help.

There are trade-offs. The exercise takes time from people who are already busy. It will also surface things you would rather not know, such as a tool nobody owns or one that has been handling customer data without anyone checking. But finding that out yourself is far cheaper than having a customer, a supplier or a regulator find it for you. Start with what you can list this week, put a name against every entry, and treat the gaps as your first set of jobs.

Common questions

Do small businesses need an AI inventory?

Yes, if you use AI in any way that touches customers, staff or money. An inventory is the simplest way to know what you are using, who is responsible and where the risks sit. Both the Corporate Business Alliance and the government’s Generative AI Framework recommend one. For a small firm, a shared spreadsheet is enough.

How often should I update my AI inventory?

Review it at least quarterly and update it whenever you buy, switch on or retire an AI tool. The government’s Generative AI Framework advises keeping the inventory regularly updated. The most reliable habit is a rule that no new tool goes live until it has an entry in the inventory with a named owner.

Who should be responsible for an AI inventory in a small business?

Give overall responsibility to one senior person, usually the managing director, operations lead or whoever already handles risk and compliance. Each tool should also have its own named owner, the person who uses it most and can spot when something goes wrong. Shared ownership by a whole team tends to mean nobody checks it.

Sources

• Corporate Business Alliance: Establishing an AI system inventory, CBA Practice Note
• UK Government: Generative AI framework for HM Government
• DSIT: UK Business Data Survey 2026
• Office for National Statistics: Artificial intelligence in UK businesses
• OECD: SME Technology Adoption in the United Kingdom
• Business in the Community: Responsible AI Framework