An organization's CIO provided the AI steering committee with a list of AI technologies in use and tasked them with categorizing the technologies by…

The foundational step in any technology risk management process is asset identification and management. Before the AI steering committee can categorize technologies by risk, they must first ensure these technologies are formally recognized, documented, and tracked as organizational assets. Including them in the asset inventory provides a definitive list, establishes accountability, and creates the necessary baseline for all subsequent risk assessment, vulnerability analysis, and categorization activities. This aligns with established governance frameworks where asset inventory precedes risk analysis.

A. Grouping similar products is a useful step for analysis, but it can only be performed accurately after a complete and formal inventory of all AI assets has been established.

B. Identifying vulnerabilities is a core component of the risk assessment process itself, which must be preceded by the formal identification and inventorying of the assets to be assessed.

D. Assessing risk levels against appetite and regulations is the ultimate goal, but it cannot be the initial step. This assessment requires a clearly defined scope, which is provided by the asset inventory.

1. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. The process BAI09 Managed Assets emphasizes the need to "manage I&T assets through their lifecycle" which begins with identification and recording of the assets in an inventory. This is a prerequisite for managing risks associated with those assets. (Reference: BAI09.01 - Identify and record current assets).

2. National Institute of Standards and Technology (NIST)

AI Risk Management Framework (AI RMF 1.0)

January 2023. The "Govern" function

which is foundational to the framework

includes establishing "processes...for AI risk management." A fundamental process is creating and maintaining an inventory of AI systems to understand the scope of risk management activities. The "Map" function also explicitly involves cataloging AI systems to understand their context before assessing risks. (Reference: Section 3.1

Govern Function; Section 3.2

Map Function).

3. ISACA

Artificial Intelligence: An Audit and Assurance Framework

2023. The framework's governance domain implicitly requires an inventory of AI systems. Effective governance

including defining policies

roles

and responsibilities

can only be applied to a known and managed set of assets. Risk management activities described in the framework presume that the organization has identified the AI systems in scope. (Reference: Section 2

AI Governance).