Work the AI inventory

Select Governance → Governance Inventory.

The unfiltered list shows every asset, riskiest first, 25 to a page. Catalogue models — managed models on the chat channel — are folded into one expandable row so they do not bury the discovered ones.

Type into Search key… and press Enter.

The search is a substring match on the asset's canonical key. It commits on Enter or when the box loses focus, and it lands in the address bar.

Set Kind, Status and Risk, each defaulting to Any.

Filtering unfolds the catalogue rows: a filter is a question, and folding part of its answer away would answer a different one. Reset appears as soon as any filter is active.

Copy the address.

Every filter is in the URL, so /governance/inventory?status=shadow is a link you can paste into a ticket and the recipient sees the same list. Half the value of a shadow-AI finding is being able to send it to the person who has to act on it.

Select a row.

The drawer shows kind, owner, first and last seen, the fingerprint that identifies the asset, and links to the same thing elsewhere in the product.

Read Evidence.

A rolling window of observations — scanner, confidence, timestamp, basis — proving the asset is real. The window length is the Evidence window setting, 20 by default. It is not a usage series; the helper text says so, and usage lives on the AI Usage page.

Read Who used it.

The top identities over the usage lookback window, from the same feed the Shadow-AI report reads. Owner is who accepted accountability; this is who uses the thing, and operators read the first as if it were the second.

Read Findings.

Each row names the finding type, its status, the day it was observed and why. No findings against this asset when there are none.

Select Register on the row, or Register in the drawer.

The dialog names the asset, its kind and the channel it was seen on.

Enter Owner email, and Owner team if you use it.

The owner is the person accountable, not a user of the asset. The email must be valid or the dialog refuses with Enter a valid email address.

Fill in Risk profile: Domain, Capabilities, Human oversight, Affects decisions and Users informed.

Every boolean is three-state — Yes, No, Not stated — because an absent answer and a declared "No" mean different things to the classifier. The dialog warns before you submit: a prohibited capability produces This asset will be classified Unacceptable under AI Act Art. 5., and an Annex III domain with a declared decision effect produces An Annex III domain with a declared decision effect classifies this asset High risk.

Select Register.

The toast names the resulting tier and how many findings closed. Status moves to Registered, and if the current Status filter no longer matches, the toast adds It moved to Registered, so the current Status filter no longer shows it. — because "it disappeared" is the report that came back before it did.

Select Decommission on the row.

The dialog opens with the warning No scan will undo this and The asset keeps its evidence and stays in the inventory, but it stops raising findings and discovery can never move it off this status. Only registering it again brings it back.

Write Reason (optional) — up to 500 characters.

Free text on purpose. The helper says what it is for: The sentence an auditor reads a year from now. Stored on the audit event with your username and the time.

Select Decommission.

Status moves to Decommissioned, every open finding on the asset closes, and an audit event records the previous status, your reason and the closed findings. Decommissioning an already-retired asset changes nothing and emits nothing.