Learn AI the practical way, and get ready for the new jobs it is creating.

Learn

Courses
Roadmaps
AI careers
Labs
Big map of AI
Certifications

Practise

Interview questions
Interview prep path
Prompt library
Calculators

Explore

AI tools
Models
Weekly digest
What's new

Company

Pricing
Contact
Verify a certificate
My plan

Privacy Terms Refunds Cookies

– visitors– online now

© 2026 Route to AI. For education, not professional advice. With your permission (or by default where the law allows), we count visits anonymously with a random ID stored in your browser. No name, email or IP address is saved for this. See cookies and storage.

AI Inventory & Risk Classification · AI Governance & Risk Lead · Route to AI

Courses ✦AI careers My learning Roadmaps Labs Pricing

Sign in Start learning

Courses

Lessons and outlineLesson 2 of 10

Course0 / 10 done

AI Governance & Risk Lead

Overall completion 0%

Lessons

What an AI Governance & Risk Lead Does
AI Inventory & Risk Classification
Policies, Standards & Controls
Laws & Frameworks: A Working Map
Data Privacy & Intellectual Property Risks
Fairness, Transparency & Explainability
Third-Party & Vendor Risk
Testing Controls, Oversight & Assurance
Incidents, Reporting & Regulators
Governance Interviews & Case Practice

On this lesson

In plain English
Try it: Lower risk or higher risk?
What counts as an AI system
The inventory record
Risk tiers
Questions that set the tier
Keeping it alive
Key takeaways
Hands-on exercise
Check yourself

Course0 / 10 done

AI Governance & Risk Lead

Overall completion 0%

Lessons

What an AI Governance & Risk Lead Does
AI Inventory & Risk Classification
Policies, Standards & Controls
Laws & Frameworks: A Working Map
Data Privacy & Intellectual Property Risks
Fairness, Transparency & Explainability
Third-Party & Vendor Risk
Testing Controls, Oversight & Assurance
Incidents, Reporting & Regulators
Governance Interviews & Case Practice

On this lesson

In plain English
Try it: Lower risk or higher risk?
What counts as an AI system
The inventory record
Risk tiers
Questions that set the tier
Keeping it alive
Key takeaways
Hands-on exercise
Check yourself

AI Governance & Risk LeadLesson 2

19 min

AI Inventory & Risk Classification

Find every AI system, record it and sort it into clear risk tiers.

In plain English

You cannot govern what you cannot see. Keep an inventory of every AI system, including vendor features. Each record names an owner, purpose, data, affected people, human check and tier. Use four clear risk tiers and match review effort to the tier.

Risk tier: A level, from minimal to high, that decides how much review a system gets.
Affected people: Those whose lives or work the system touches.
Review date: The day the record must be checked again.

Picture it

Risk tiers decide how much review

Not allowed

Stop and record

0 / 10 finished0% · AI Governance & Risk Lead

High

Formal board, full testing

Limited

Owner, security and privacy review

Minimal

Self-check and register

Try it yourself

Lower risk or higher risk?

A starting guide, not legal advice. Sort by how much harm a wrong answer can do.

Drafting marketing text that staff review.
Screening job applicants.
Summarizing internal meeting notes.
Deciding who gets a loan.
Helping doctors choose a treatment.
Suggesting subject lines for emails.

0 of 6 right

You cannot govern what you cannot see. The first job is an inventory: a list of every AI system in use. The second job is sorting them by risk, so that effort goes where harm could be greatest. This lesson shows how to build the inventory and a simple risk classification that teams will actually use.

What counts as an AI system

Tools staff use directly, such as chat assistants and writing helpers.
AI features inside software you buy, such as a helpdesk with auto-replies.
Systems you build, such as a search assistant for your own documents.
Models and services you call by API in a product.
Older machine learning models, such as scoring and forecasting.

Include the hidden ones. Many vendors add AI features to existing products with a software update. Ask vendors to tell you when they do.

The inventory record

inventory-record.md

SYSTEM NAME / ID:
PURPOSE (one sentence):
BUSINESS OWNER:                TECHNICAL OWNER:
BUILT OR BOUGHT:               VENDOR AND MODEL (if any):
WHO USES IT:                   WHO IS AFFECTED (staff, customers, the public):
DATA USED (types; any personal, sensitive or confidential data?):
WHERE DATA GOES (provider, region, retention):
DECISIONS IT MAKES OR SUPPORTS:    HUMAN CHECK? (who, when):
RISK TIER:                     DATE REVIEWED:      NEXT REVIEW:
CONTROLS IN PLACE:             OPEN ISSUES:
LINKS: design doc, test results, vendor contract, privacy assessment

Risk tiers

Use a small number of tiers, with clear tests. Four is plenty. The tiers should match the way you review.

risk-tiers.md

TIER 1 - MINIMAL
  Internal drafting or search; no personal or confidential data; a person reads all output.
  REVIEW: self-check against the policy; owner records it in the inventory.

TIER 2 - LIMITED
  Customer-facing text with checks; or internal tools using confidential data;
  actions that can be undone.
  REVIEW: owner + security + privacy review; basic testing evidence.

TIER 3 - HIGH
  Affects people's rights, money, health, jobs or safety; makes or strongly shapes
  decisions about individuals; actions that cannot be undone.
  REVIEW: formal board; full testing, bias and oversight checks; sign-off by a senior owner.

TIER 4 - NOT ALLOWED
  Uses your policy or the law forbids.
  REVIEW: stop; record the decision.

Questions that set the tier

Could the output affect a person's job, credit, health, education, benefits or legal position?
Does it handle personal, sensitive or confidential data?
Is it used by the public or customers, or only by staff?
Can a mistake be reversed? How quickly?
Is a person meaningfully involved in the decision, with time and authority to change it?
Does it act on its own, or only suggest?

⚠A person who rubber-stamps every output is not real oversight. Be careful when a tier drops because a human is in the loop.

Keeping it alive

Make registering a system part of the normal process: no registration, no production access or budget.
Review the inventory each quarter. Remove retired systems and update changed ones.
Ask procurement to flag any new software with AI features.
Recheck the tier when the use changes, such as adding customer data or a new action.

→Start with a simple spreadsheet. A tool can come later. The habit of keeping the list current matters more than the tool.

Key takeaways

✓Keep an inventory of every AI system: tools staff use, vendor features, systems you build and models called by API.
✓Each record names an owner, purpose, data, affected people, human check, tier and next review date.
✓Use four clear tiers, from minimal to not allowed, and match review effort to the tier.
✓Recheck tiers when use changes, and tie registration to budget and access.

Hands-on exercise

Classify five systems

Invent five systems: a meeting summarizer, a support chatbot, a resume screener, a code assistant and a loan pre-check.
Fill in a short inventory record for each, with data and affected people.
Assign a tier to each, and write the questions that decided it.
Write the review steps each tier needs, in two lines.

Check yourself

Q1Why include vendor features in the inventory?show answer

Vendors add AI to existing products with updates. Those features touch your data and affect people, so they need an owner and a tier too.

Q2Why should registration be tied to budget or access?show answer

It gives teams a reason to register. No registration, no production access, so the inventory stays complete.

Q3When do you recheck a tier?show answer

When the use changes, such as new data, new users or a new action, and on a regular schedule.

Up next

Lesson 3: Policies, Standards & Controls

← Previous Course overview