Inventory and Lifecycle Gates

You cannot govern what you cannot see

Maintain an inventory (register) of all AI systems and use cases: owner, purpose, tier, data sources, model or vendor, evaluation results, human-oversight arrangement, approval date and next review date. Add lifecycle gates: idea (use-case canvas), design (impact assessment for higher tiers), pre-launch (evaluation results and sign-off), live (monitoring), and retirement (data deletion). A system that lacks a required item does not pass the gate.

A gate check, run

I ran this. The entry is missing its evaluation results and privacy review, so the gate lists exactly those two items to fix.

REQUIRED = ["owner", "purpose", "data_sources", "risk_tier",
            "eval_results", "human_oversight", "privacy_review"]

def missing(entry):
    return [k for k in REQUIRED if not entry.get(k)]

print(missing({"owner": "A. Rao", "purpose": "FAQ bot", "data_sources": ["kb"],
               "risk_tier": "limited", "eval_results": "",
               "human_oversight": "agent handoff"}))

Output:

['eval_results', 'privacy_review']

Finding overdue reviews, run

Each entry has a last-review date and a review interval in days. On 1 October 2026 the FAQ bot is 34 days overdue; the other two are within their intervals.

from datetime import date
inv = [("FAQ bot", date(2026, 3, 1), 180),
       ("Resume screener", date(2026, 8, 20), 90),
       ("Summariser", date(2025, 12, 1), 365)]
today = date(2026, 10, 1)
for name, last, days in inv:
    due = (today - last).days - days
    print(name, "OVERDUE by" if due > 0 else "ok", max(due, 0))

Output:

FAQ bot OVERDUE by 34
Resume screener ok 0
Summariser ok 0

Higher tiers, shorter intervals

Review high-tier systems more often (quarterly or on any significant change) and low-tier ones annually. Automatic reminders from the inventory keep reviews from quietly lapsing.

Quick check: Why keep an inventory of AI systems?

• It speeds up the models
• It is only decoration
• You cannot govern, review or audit systems you do not know exist
• It replaces risk assessment