Ownership must survive the pilot
Someone must own the use, technical service, quality decision, information protection, monitoring, and incident response. One person may hold several responsibilities, but gaps should not be hidden behind a general “AI team” label.
Completed inventory entry — fictional
Make the inventory actionable
Link the entry to the intended use, assessment, current configuration, evidence, open issues, and operating instructions. A spreadsheet containing only product names does not tell an owner whether a tool is still being used within its approved boundary.
Exercise
A department adds a browser AI extension outside the approved pilot. What should the governance process resolve?
Show suggested answer
Determine its actual use, data exposure, permissions, decision reliance, ownership, and status. Evaluate whether it should be disabled, restricted, or formally assessed through the organization’s process. Do not assume the original pilot assessment covers an unrelated extension.
Expected records
An owned AI inventory entry linked to intended use, current configuration, training, assessments, open issues and change triggers. Adapt record names and detail to the applicable procedures; these are practitioner examples, not a universal mandatory document list.
Relevant regulations and guidance
Regulations set requirements within their scope; guidance offers recommendations or explains applicable expectations; standards depend on adoption or incorporation. Voluntary frameworks do not establish compliance. The lesson's controls, test designs and example records are practitioner suggestions unless explicitly identified otherwise.
Voluntary framework · National Institute of Standards and Technology · NIST AI 100-1 · January 2023
Scope: United States · Cross-sector AI governance and risk management, including generative AI.
Relevance to this lesson: Provides voluntary governance context for ownership and accountability.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicabilityStandard · International Organization for Standardization · Edition 3 (2016)
Scope: International · Organizations performing medical-device lifecycle activities or related services.
Relevance to this lesson: Consider applicable medical-device QMS responsibilities where the standard is adopted or incorporated; no licensed clause text is reproduced.
Publication status: Final / published. Source checked 21 September 2026.
Publisher metadata and public scope were checked. The full licensed standard was not reviewed; retained clause explanations are practitioner material and require confirmation against an authorized copy and applicable adoption.
Source details and applicabilityEditorial information and limitations
Educational chapter · Editorial version 2.0. The update date records substantive site editing; a completed independent technical review is not claimed.
AI tools assisted drafting and structural editing. Examples and results labelled fictional or synthetic are teaching material. Adapt the methods to the actual intended use, applicable requirements and approved procedures.
Estimated reading time uses the written lesson at 220 words per minute, with links and Markdown formatting removed. Video time comes from the media file and is separate.
Sources, authorship and editorial policy