How to build an AI and model inventory with risk tiering
Build the inventory by collecting every AI and model use from business lines, procurement, IT change and vendor contracts; record owner, purpose, data, provider and decisions affected; score materiality on impact, exposure, purpose, complexity and autonomy; assign a tier; and set validation depth, monitoring frequency and approval level by tier. Reconcile the inventory twice a year so embedded vendor AI is not missed.
Every supervisory text on AI starts here: SR 26-2 calls a comprehensive inventory common industry practice, and the FSB and MAS expect institutions to identify AI use and assess its materiality.
Six steps to a usable inventory
Collect
Ask each business line, procurement, IT change and vendor management for every model and AI tool in use, including AI embedded in purchased software.
Record
Enter each use case with owner, purpose, type, provider, data and decisions affected.
Score
Rate impact, exposure, purpose, complexity and degree of autonomy on a simple 1 to 3 scale.
Tier
Convert scores to high, medium or low, applying defaults for customer-impacting and agentic uses.
Set controls by tier
Define validation depth, monitoring frequency, approval level and human oversight for each tier.
Report and reconcile
Report the inventory to the risk committee and reconcile it twice a year.
What should an AI inventory record?
| Field | Why it matters |
|---|---|
| Use case and purpose | Defines approved use and detects use beyond purpose |
| Business owner | Accountability for outcomes |
| Type (statistical, ML, generative, agentic) | Decides which framework governs it |
| Provider and version | Third-party and change risk |
| Data used, including personal data | Data governance and privacy |
| Decisions or processes affected | Exposure and purpose, i.e. materiality |
| Materiality tier and date | Drives control intensity |
| Validation status and date | Evidence of effective challenge |
| Monitoring metrics and last result | Performance and drift |
| Fallback and kill switch | Resilience |
How many tiers should we use?
Three is enough for most institutions: high, medium and low. Default anything affecting customers, regulatory reporting or financial risk to at least medium, and treat agentic AI as high until evidence supports a lower tier.
Primary sources (reviewed 17 Oct 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
How often should the AI inventory be updated?
Continuously as use cases change, with a full reconciliation against licences, contracts and network traffic at least twice a year.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.