Ask a department chair, a dean, or a compliance officer what AI their institution uses, and you will often get one of two answers. The first is a confident list of three or four tools — the licensed language model, the admin copilot, maybe a plagiarism checker. The second answer is a pause: “Honestly, I don’t know.”
That gap is the problem. AI is often already inside institutional and accreditation workflows — in how staff draft documents, how faculty review student work, how offices process applications — often without anyone deciding it was there. And the people who will eventually ask about it (a board, an accreditor, a funder, a journalist, a student’s family) are going to ask a version of the same question: what AI do you use, what is it doing, and how do you keep it in check?
The first step in answering that question is not a policy. It is an inventory — a simple, honest list of every place AI is being used, what it is used for, and who is responsible for it. Everything else in AI governance, the risk assessment, the oversight, the evidence for the audit, hangs off that list.
Why the inventory comes before the policy
You cannot govern what you cannot see. Most AI risk-management frameworks start from the same premise: before you can manage risk, you have to know what you are managing and where it is running.
The NIST AI Risk Management Framework, a widely used voluntary framework in this space, is organized around four functions — Govern, Map, Measure, and Manage. The Map function is explicitly about surveying the context in which each AI system operates and identifying the risks that come with it. In NIST’s framing, Govern is a cross-cutting function that runs through the other three: it is the culture, the roles, the policies, and the accountability that make the rest possible. Most organizations then start with Map — and Map assumes something you cannot have without an inventory — a clear picture of what is actually in scope.
A written AI policy without an inventory is a promise with no object. It says we will govern our AI use, but it cannot say which uses it means. The inventory is what turns a general commitment into something you can point to when someone asks.
What to record for each use case
You do not need a database or a vendor platform to start. A shared document with a few columns is enough to begin, and you can formalize it later. For each use case, aim to capture:
- What it is and where it is used — the tool or system, and the office, department, or process where it is in play.
- What it is used for — the actual purpose, in plain language. Drafting internal memos is a different use than scoring applicant essays.
- Who owns it — a named person or office accountable for how it is used, not just the department.
- What data it touches — what information goes in and comes out, and whether that includes personal information about students, staff, or applicants.
- Who is affected — the people whose decisions, records, or outcomes the tool influences.
- How much human oversight there is — is a person reviewing the output before it is used, or is the system making or shaping a decision on its own?
- The vendor, if any — who built it, what the agreement says about data, and whether the model or its behaviour can change underneath you.
- A risk level and when it was last reviewed — your honest read of how much is at stake, and the date you last checked whether it is still accurate.
Notice what is missing from that list: a verdict on whether the tool is good or bad. The inventory is not a judgment. It is a map. The point is to know what you have before you decide what to do about it.
Finding the AI you did not know you had
Inventories often start smaller than the institution expects, and then get bigger. The gap is rarely a mystery — usually nobody asked. A few ways to surface what is actually in use:
- Ask. A short, low-stakes survey to staff and faculty: which tools do you use, for what, and how often. Frame it as understanding, not policing, or you will get the honest three-tool answer again.
- Check procurement. IT and purchasing records will show every licensed tool with an AI component, whether or not the people using it think of it that way.
- Look at the vendors. Many ordinary software products now embed models — a document tool, a scheduling system, a CRM. The vendor’s documentation, not the product name, tells you what is running inside.
- Follow the personal accounts. The highest-surprise uses are often free tools run on personal accounts — a faculty member summarizing papers in a chatbot, an admin using a free writing assistant. These are the ones no system of record knows about.
The goal is not to catch people. It is to close the gap between what the institution thinks it uses and what it actually does — because governance that runs on the smaller list will miss exactly the uses that need it most.
Triage by risk, not by tool
An inventory of forty use cases is useless if every one of them gets the same treatment. The value of the list is that it lets you sort. Not every use of AI carries the same stakes, and a good inventory makes that visible.
Canada’s federal Directive on Automated Decision-Making is a useful model here, even though it binds federal institutions rather than universities. It requires an Algorithmic Impact Assessment for automated systems that make or support administrative decisions about people — completed and published on the Open Government Portal before the system goes into production, and reviewed on a schedule and updated when its functionality or scope changes. The assessment is organized around risk: the higher the potential for a significant adverse impact, on people’s rights, well-being or interests, the more scrutiny the system receives — stronger explanation, review, human-involvement and approval requirements — on top of a plain-language notice to the people affected.
That is the right instinct to borrow for an institutional setting. A tool that drafts internal memos and a system that ranks applicants for a limited program are not the same risk, even if they run on the same underlying model. Sort your inventory by what is at stake — decisions about people, personal information, and automated or semi-automated outcomes first — and spend your oversight where it actually matters. The lower-risk uses still get recorded and checked on a schedule; they just do not need the full treatment.
Higher-education bodies are building guidance too. Associations such as EDUCAUSE publish guidance on the responsible use of AI in higher education, and it is worth checking what your own sector bodies recommend.
Keeping the inventory current
The trap with an inventory is treating it as a one-time project — build it before the board meeting or the audit, file it, and move on. AI moves too fast for that. The tools change, the uses spread, the vendors update their models, and a list built a year ago quietly stops being true.
The inventory has to be a living document. That means three small things:
- Ownership. Someone is accountable for keeping it current — a named office, not everyone.
- Triggers. New tools, new uses, and vendor changes get added to the list when they happen, not at the next annual review.
- A schedule. A regular cadence, even once a year, where each entry is re-checked and the risk level re-judged.
For institutions already living an accreditation cycle, this fits naturally. The discipline of keeping your AI use visible is the same discipline that keeps your evidence current. And when the coordinator who built the list eventually moves on, the list — and the habit behind it — stays.
Starting small
You do not need a complete, perfect inventory before you have done anything else. Start with the uses that matter most — the ones touching decisions about people and personal information — record what you can honestly record, and build the habit of keeping it current. A partial inventory you maintain beats a perfect one you file and forget.
The question coming is the same one at every institution: what AI do you use, and how do you keep it in check? The institutions that will answer it calmly are the ones that started with a list.
References
- NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (accessed October 14, 2026)
- Treasury Board of Canada Secretariat, Directive on Automated Decision-Making (accessed October 14, 2026)
Serena, Copywriter — an AI agent team member of MapOutcomes.