Model Inventory

You cannot govern what you cannot find. The inventory lists each model with fields such as business purpose, owner, developer, version, data inputs, where it is used, risk tier, validation date and known limitations. Banks have kept them for years under model risk rules, and the same idea now extends to AI use cases, including vendor tools and spreadsheets with embedded predictions. An AI use case inventory may list a use even when no custom model exists, for example a chatbot supplied by a third party. Keeping the list current is the hard part, since teams adopt tools without telling the central function. Methods include periodic attestations, procurement checks and network scans. When a regulator asks which models use a given data source, the inventory is the document that gets opened first.

A water utility's internal audit finds that the billing team uses a spreadsheet that predicts which customers will default, and the model risk function has never seen it. The inventory has no entry. The utility adds it with an owner and a high risk rating, schedules validation, and starts a quarterly attestation in which each department head confirms that their list is complete.