AI Model and Dataset Inventory Policy

How to use this document

• What it is for. This is a base policy that sets which AI models, datasets and third-party AI services (APIs) must be inventoried, with what minimum metadata, who maintains them, which controls apply at each lifecycle stage and how they are retired. It includes the inventory template with field-by-field instructions and a completed example.
• Who should own it. Usually data science, architecture or the model risk management function, with AI governance, IT and privacy. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide where the inventory will live (MLOps platform, configuration management database or a controlled spreadsheet) (Section 11), how model materiality is classified (Section 5), who validates high-tier models (Section 9) and how long records of retired assets are kept (Section 10).
• Relationship with other documents. The "AI System Inventory" is the single register of tools, systems, agents and models, with their risk level, profile, developer, license and hosting mode. This policy does not duplicate it: it sets the life cycle and technical detail of models and datasets (versions, validation, monitoring, retirement) and links to it through identifiers. Each dataset has its "Dataset Datasheet" and each third-party model, its "Third-Party and Open-Weight Model Provenance Sheet".
• Fields to complete. Replace the bracketed text, such as [ORGANIZATION NAME], [RESPONSIBLE FUNCTION], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE]. Adapt the fields in Section 6 to your inventory tool.
• Country variants. This document has no country variants. Financial institutions, insurers and organizations in sectors with model risk management rules should check in "Related regulatory references" whether their supervisor expects additional fields, committees or reports and add them.
• Review. Ask risk management, privacy and security to review Sections 5, 7 and 10, and legal to confirm retention periods.
• Approval and publication. Have it approved by management or the [AI COMMITTEE], record the approval in "Version history" and communicate it to data, development, architecture and procurement teams and to the owners of processes that use AI.

AI Model and Dataset Inventory Policy

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy and inventory owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Inventory location	[COMPLETE: tool or link]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 [ORGANIZATION NAME] keeps a single, up-to-date inventory of the AI models, datasets and third-party AI services it uses, so that it knows at all times which AI operates in its processes, who answers for each asset, what data it consumes, what risk it carries and where it is in its lifecycle.

1.2 The inventory is used to manage risk, respond to audits, customers and authorities, handle individuals' requests about their data, control costs and vendors and retire what is no longer used in an orderly way.

2. Scope

2.1 The following must be inventoried:

a) Models, whether in-house, fine-tuned or third-party, that are in a pilot with real data or in production, or that influence decisions, processes or products;
b) Datasets used to train, fine-tune, validate or test those models, or to feed them in operation, including knowledge bases for retrieval-augmented systems;
c) Third-party AI services integrated into the organization's applications or processes (model APIs, cognitive services, AI features enabled in contracted software), and open-weight models downloaded and run by the organization; their main entry is in the "AI System Inventory," and their version and changes are managed here (Section 6.3);
d) [OPTIONAL] Relevant configurations of generative AI systems, such as system prompts, tools connected to agents and content filters, when they determine the system's behavior.

2.2 Experiments and prototypes that use only fictitious, public or anonymized data and do not connect to production systems are out of scope. They must be inventoried as soon as they use real organizational data or are promoted to pilot.

2.3 This policy applies to all functions, subsidiaries and teams, including vendors that develop or operate models on the organization's behalf.