Stage 2: Inventory and intake | ClearPath AI Governance

What this stage is for

You cannot govern what you have not found. Start with a register of every AI system, including AI built into vendor products and tools staff use without approval (often called shadow AI). Then add an intake step so every new idea or purchase is triaged before it is built or bought.

Who is involved

AI governance lead, Product owner, Procurement, IT, Engineering and data science.

Key outputs: AI register, intake records.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Ask each team which AI tools and models they build, buy or use, including AI features switched on inside existing software.
Record each system with an owner, purpose, source (in-house or vendor), data used, role and status.
Add a requirement that new AI uses go through an intake form before they are built or bought.
Triage each intake into a route: stop and escalate, full review, standard review or fast track.
Review the register on a schedule and flag systems whose review date has passed.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

A register is the base for working out each system's risk tier and your role as provider or deployer. European Union page

Add the states and cities where each system is used. State and city rules (for example hiring tools in New York City) depend on where people are affected. United States page

Record where personal data is used. It drives data protection impact assessments. United Kingdom page

Record which systems use digital personal data of people in India, and which host or generate content for users there. India page

Tools and templates

Tools

Use-case intake and approval: A front door for any new AI idea or purchase.
AI register: Keep your own register in the browser.
Shadow AI survey kit: Find AI tools staff use without approval.

Templates

AI system register: CSV, XLSX
Shadow AI staff survey and amnesty message: MD, DOCX
Use-case intake form: MD, DOCX
All templates for every stage

Common mistakes

Counting only models your team built and missing vendor AI.
A register that is out of date a month after it is created.
Intake that is so heavy people route around it.

You're done when…

Every known AI system is on the register with an owner.
New uses cannot start without intake.
Each system has a review date.

Reviewed 3 Oct 2026.

← Stage 1: Set up governance · Stage 3: Assess risk and impact →