AI Governance and Program Management · Topic 4 of 6
AI Asset Inventory and Data Life Cycle Management
Identifying, inventorying and classifying AI assets: models, datasets, prompts, vector stores, AI bills of materials, model cards and the data life cycle.
- 5 min
- The AI inventory is the foundation for risk assessment, compliance and incident response.
- Every AI asset needs an owner and a classification.
- Classify by data sensitivity and by AI risk tier.
What it is
You cannot secure AI you do not know about. AI asset management identifies every AI system and the assets it depends on, records them in an inventory, assigns an owner, and classifies them so the right controls apply.
Data life cycle management follows the data used by AI from collection to disposal. AI adds new data assets, such as training sets, model weights and embeddings, that inherit sensitivity from the data they were built from.
How it works
What counts as an AI asset
| Asset | Why it matters |
|---|---|
| AI systems and use cases | The unit of governance: purpose, owner, users, risk tier |
| Models | In-house, fine-tuned, open-source or vendor models, each with a version |
| Model weights and artifacts | Valuable intellectual property; tampering changes behaviour |
| Training, validation and test data | Sensitivity, licensing and integrity drive model risk |
| Retrieval sources and vector stores | Knowledge bases used at inference; embeddings can reveal source content |
| Prompts and system prompts | Encode business logic and guardrails |
| Pipelines, notebooks and code | Build and deploy the model |
| Agents, tools and integrations | Actions the AI can take in other systems |
| Credentials and API keys | Access to model services and data |
| Third-party AI services and embedded features | AI inside SaaS products and vendor platforms |
Discovering AI
AI arrives through many routes, so discovery uses several sources: procurement and expense records, software inventories, network and cloud access logs, browser extension lists, development repositories, vendor release notes that announce new AI features, and simply asking business units. Every new use case should enter the inventory through the approval procedure.
Inventory content
A useful AI inventory records the purpose, business owner, model owner, model and version, provider, data used, users and affected people, deployment location, risk tier, regulatory classification, approval status and date of last assessment. The same record links to the risk register and the vendor record.
Classification
AI assets are classified on two axes:
- Data sensitivity: the classification of the data in training sets, prompts, retrieval sources and outputs, using the organization's existing scheme.
- AI risk tier: the potential impact of the use case, considering decisions about people, safety, autonomy, scale and regulatory category.
Derived assets inherit sensitivity. A model fine-tuned on confidential records, or a vector store built from restricted documents, is at least as sensitive as its sources, because outputs can expose that content.
Documentation artifacts
| Artifact | What it records |
|---|---|
| Model card | A model's intended use, limitations, performance, evaluation results and known risks |
| Datasheet for a dataset | Origin, collection method, content, consent, known gaps and recommended uses |
| AI bill of materials (AI BOM) | The components of an AI system: models, datasets, libraries and their versions and sources, extending the software bill of materials idea |
| Model registry | The controlled store of approved model versions with lineage and approval status |
Software bill of materials standards have added AI support: CycloneDX includes a machine learning BOM, and SPDX 3.0 has AI and dataset profiles. An AI BOM lets the organization find every affected system quickly when a component is found to be vulnerable.
The AI data life cycle
| Stage | Key security and governance concerns |
|---|---|
| Plan and acquire | Lawful basis, consent, licence terms, provenance |
| Prepare and label | Quality, labelling accuracy, removal of unneeded personal data |
| Train and tune | Integrity, access control, segregation of environments |
| Validate | Independent test data kept separate from training data |
| Deploy and use | Prompts, retrieval data and outputs classified and logged |
| Monitor | Drift in the data the model sees |
| Retain and archive | Records needed for audit and regulation |
| Dispose | Deleting data and, where needed, retiring models trained on it |
Disposal is harder for AI. Deleting a record from a dataset does not remove what a trained model has learned from it, so retention decisions must consider models and embeddings as well as the original data.
A worked example
An internal audit finds that three departments use AI features that nobody approved: a meeting summarizer, a vendor CRM assistant and a code assistant.
The security manager adds all three to the inventory with business owners, classifies the data each processes, assigns risk tiers and schedules assessments. The approval procedure is updated so that vendor AI features and new SaaS tools are captured before use.
How the exam asks about this
- "What should the security manager do FIRST to secure the organization's use of AI?" Establish an inventory of AI systems and assets.
- "A vector store is built from restricted HR documents. How should it be classified?" At least restricted, the same as its source data.
- "Which artifact BEST helps identify systems affected by a vulnerable model component?" An AI bill of materials.
What to remember for the exam
- The AI inventory is the foundation for risk assessment, compliance and incident response.
- Every AI asset needs an owner and a classification.
- Classify by data sensitivity and by AI risk tier.
- Models, embeddings and vector stores inherit the sensitivity of their source data.
- Model cards, datasheets, AI BOMs and a model registry document what you have.
An inventory that covers only models built in-house misses most enterprise AI. Include vendor services, open-source models and AI features embedded in existing software.
Common mistakes
Classifying a model as internal by default. A model trained on sensitive data can reveal that data in its outputs, so it takes the source classification.
Treating discovery as a one-off project. AI features appear with software updates and new subscriptions, so discovery must be continuous and built into procurement and change processes.
Forgetting disposal. Deleting source data while keeping models and embeddings built from it can leave the information in use.
Check yourself
Why does a fine-tuned model inherit the classification of its training data?
Because the model can reproduce or reveal information from that data in its outputs.
What does an AI bill of materials record?
The components of an AI system, such as models, datasets and libraries, with their versions and sources.
Name two sources for discovering unapproved AI.
Any two of procurement and expense records, network and cloud logs, software inventories, browser extensions, vendor release notes or business unit surveys.
Topic 4 of 6 in AI Governance and Program Management
Test yourself on AI Governance and Program Management
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.