Lesson 5 of 6
The AI inventory and the governance evidence pack
8 min
Listen to this lesson
You can't govern what you haven't listed. The AI inventory is the register of every AI system and use case in your SAP landscape, from Joule features to custom agents. The evidence pack is what you hand an auditor, a works council or employee representatives, or a steering group to show the inventory is managed. Both are program deliverables, and both get easier if you start them during the project rather than after go-live.
What goes in the inventory
| Field | Example: requisition agent | Example: applicant ranking (what-if) |
|---|---|---|
| ID and name | AI-017 Requisition drafting agent | AI-021 Applicant ranking for Detroit assembly |
| Business owner / technical owner | Procurement lead / Theo | HR director / HR systems lead |
| Vendor and component | Custom agent; MCP Gateway server; SAP S/4HANA | Vendor AI feature in the recruiting system |
| Role under the AI Act | Provider (built in-house) | Deployer |
| Risk class and rationale | Minimal risk; goods procurement, human release | High-risk, Annex III point 4; profiles candidates |
| Data used | Material, plant, stock, supplier Lakeside Components | Applicant CVs and assessment results (personal data) |
| Human oversight | Buyer releases over $10,000; PO approval over $25,000 | Recruiter reviews every ranking; can override |
| Logs and retention | Tool-call log, 13 months | Vendor logs plus decision records, at least six months |
| Evaluation and last test | Evaluation set of 60 cases, passed 2026-09-30 | Bias and accuracy review required before use |
| Status and review date | Pilot; review quarterly | On hold; decision group review |
An AI inventory entry, with Contoso examples.
Where should the inventory live? Contoso keeps it in SAP Cloud ALM as requirements with a dedicated "AI system" classification, so each entry links to its user stories, test cases and transports. Any register works if it is complete, owned and linked to evidence.
Use NIST AI RMF as a practical checklist
The EU AI Act tells you what high-risk systems need. The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework that helps with how to manage AI risk day to day. It has four functions: Govern (culture, roles, policies), Map (context and risks of each system), Measure (analysis, testing and tracking of those risks) and Manage (prioritizing and acting on them). NIST also published a Generative AI Profile (NIST AI 600-1, July 2024) with risks specific to generative AI. AI RMF 1.0 dates from January 2023, and NIST's site says it is being revised as part of the White House AI Action Plan, so check for a new version at your next review. Contoso uses the four functions as headings for its evidence pack.
The evidence pack
| NIST function | Evidence Contoso keeps | Maps to AI Act (high-risk deployer) |
|---|---|---|
| Govern | AI policy, RACI, inventory, training records for AI literacy, decision group minutes | Article 4 AI literacy; Article 26 assignment of oversight |
| Map | Classification worksheet per use case, intended purpose, vendor answers, data inventory | Article 6 classification; Article 26 instructions for use |
| Measure | Evaluation sets and results, bias and accuracy checks, test sign-offs | Article 26 monitoring; input data relevance |
| Manage | Control designs, monitoring alerts, kill-switch rehearsal records, incident log, communications to workers and affected people | Article 26 logs, informing workers, informing the provider of risks |
Contoso's evidence pack structure, organized by NIST AI RMF function and mapped to AI Act duties.
- IntakeNew AI use case or feature activation requested; inventory entry created.
- ClassifyNadia runs the classification method; rationale recorded.
- Design controlsOversight, permissions, logs and kill switch designed to the risk class.
- EvaluateEvaluation set run; key users sign off results.
- ApproveDecision group approves; evidence filed.
- Operate and reviewMonitoring, incidents and periodic review update the entry.
What would you do?
An internal auditor asks Priya for "proof that AI is governed" ten days before year-end. The program has 23 AI use cases. What is the best thing to hand over?
- Keep an AI inventory with owner, vendor, AI Act role, risk class, data, oversight, logs, evaluation and review date.
- Use the NIST AI RMF functions (Govern, Map, Measure, Manage) as a practical structure, mapped to AI Act duties.
- Store entries where they link to tests and changes, such as SAP Cloud ALM.
- Prepare one-page plain-language explanations for systems that affect people.
Check your understanding · not graded
Lesson check
1. What are the four functions of the NIST AI Risk Management Framework?
2. Which inventory field records whether Contoso built a system or uses a vendor's?
3. What is NIST AI 600-1?
4. Why does Contoso store its AI inventory in SAP Cloud ALM?