FAQ: What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the output leads to an action or decision. Note the approved configuration and where review or monitoring records are kept. Ask business teams about everyday use rather than limiting the inventory to engineering projects. Keep the list current as products and settings change. A simple inventory gives the team somewhere to begin when deciding what is allowed, what needs closer review, and what belongs in an audit discussion.

Related: SOC 2 audit and compliance hub.

Further reading: NIST AI Risk Management Framework.

Additional FAQs

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

When is SSAE-18 Effective?

SSAE-18 became effective for practitioners’ reports dated on or after May 1, 2017.

Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access,

SOC 1 Report – Who needs it?

SOC 1 is relevant when a service organization’s controls affect its customers’ internal control over financial reporting. Examples may include outsourced payroll or claims processing. Customers and their financial statement

How do we keep recurring SOC 2 tasks from being missed?

Create a calendar from the actual controls, not from a generic monthly checklist. Include the owner, backup, due date, evidence required, and escalation contact for each recurring activity. Add event-driven

How much review does a low-risk vendor need?

A low-risk vendor may need only a brief documented assessment. First, check: A supplier with no system access and little operational impact may need limited review. A low-cost service with

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide