> ## Content Index
> Fetch the complete content index at: https://blog.aperion.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Inventory Your AI Estate: Models, Agents, Tools and Owners
- URL: https://blog.aperion.ai/ai-inventory-guide/
- Published: 2026-11-03T12:00:00.000Z
- Updated: 2026-11-03T15:11:13.000Z
- Description: An AI inventory lists every model, agent, tool and MCP server you rent or own, each with an owner. What to record, where to look, how to keep it current.
- Author: Craig Alberino
- Tags: Guides, AI Governance, Enterprise AI, Compliance, #pipeline

An AI inventory is a list of every model, agent, tool and MCP server an enterprise uses, rented or owned, with a named owner on every line. Each line records where the model runs, which provider and version answer, what data it reaches and whose authority an agent acts on. Built from contracts, accounts and the traffic itself, it is the first governance control, because nothing missing from the list can be governed.

Inventories start as spreadsheets, and spreadsheets go stale. A team adds an agent on the platform it already uses. A SaaS renewal brings an assistant with it. A provider retires a model version on a published date. Each change adds a line the spreadsheet never sees.

This guide covers what the inventory has to contain, what the frameworks and supervisors ask for, where to look for what is missing, and how to keep it current once it exists.

*Regulatory references verified as of October 21, 2026.*

## Why the inventory comes first

Every other control assumes the list. A policy cannot apply to a model nobody knows is in use. An approval rule cannot name the person responsible for an agent that has no owner on record. An examiner's question about which model saw a customer's data starts with the inventory.

The frameworks say so directly. The NIST AI Risk Management Framework makes the inventory a governance outcome. GOVERN 1.6 reads: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." MAP 4.2 extends it to the parts: "Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented." The [NIST AI RMF](https://aperion.ai/glossary-nist-ai-rmf/) glossary entry covers the four functions. NIST states that the framework is being revised; version 1.0 remains the current text.

Bank supervisors expect a model inventory too. SR 26-2, the revised model risk guidance the Federal Reserve, the OCC and the FDIC issued on April 17, 2026, replaces SR 11-7\. Its Model Inventory section says "an effective model inventory includes sufficient information to understand model risks, so as to support effective model risk management at the individual and aggregate levels." Footnote 3 places generative and agentic AI models outside the guidance's scope and says a banking organization's own risk management and governance practices "should guide the determination of appropriate governance and controls" for them. The [SR 11-7 entry](https://aperion.ai/glossary-sr-11-7/) covers the change. A bank that inventories its credit models and leaves its language models off the list cannot answer for its whole estate from one record.

The U.S. government publishes its own. OMB Memorandum M-25-21, issued April 3, 2025, requires each covered agency to "inventory its AI use cases at least annually, submit the inventory to OMB, and post a public version on the agency's website." Nextgov reported in April 2026 that the completed 2025 federal inventory documented 3,611 use cases across 56 agencies, more than double the 2024 count.

In the EU, the AI Act puts duties on deployers of high-risk systems, including human oversight by "natural persons who have the necessary competence, training and authority" (Article 26(2)) and keeping the logs a system generates "of at least six months" (Article 26(6)). The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, moved the application date for the stand-alone high-risk systems of Annex III to December 2, 2027\. A deployer meets those duties system by system, which assumes it knows its systems.

## What the inventory has to contain

An estate has five kinds of entry, and each needs different fields. The table lists them. The [AI bill of materials](https://aperion.ai/glossary-ai-bill-of-materials/) entry in the glossary covers the component view.

| Entry                 | Examples                                                                     | Fields beyond owner and purpose                                                                                          |
| --------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Rented models         | Frontier models reached through a provider's API                             | Provider, model and version, region, data classes sent, contract terms, published retirement date, permitted alternative |
| Owned models          | Open-weight and specialized models on infrastructure the enterprise controls | Source and license, version and fine-tuning lineage, where it runs, who may call it                                      |
| AI inside SaaS tools  | Assistants and agents built into productivity, CRM and service platforms     | Vendor, which features are on, data the feature reaches, actions it can take, where its records go                       |
| Agents                | Software that plans and acts on a person's delegated authority               | The person whose authority it uses, scope of that authority, models and tools it calls, which actions need approval      |
| Tools and MCP servers | APIs, databases and services agents call                                     | Who runs it, which agents may call it, arguments allowed, data returned                                                  |

Three fields matter on every line.

- **A named owner.** A person, with a role, who answers for the entry. A team name or a cost center is not accountable for anything.
- **Data classes.** Which classes of data the entry may receive and return: public, internal, confidential, customer, regulated.
- **Authority.** For an agent, the person whose authority it carries and the limits of that authority. The [agent authority scope](https://aperion.ai/glossary-agent-authority-scope/) entry and the [AIDA guide](https://aperion.ai/blog/aida-agent-identity-guide/) cover how agents get identities and limits.

### Standard formats for the component view

Two open standards describe AI components in machine-readable form. CycloneDX added a machine learning bill of materials (ML-BOM) in version 1.5, released June 26, 2023; its capability page describes the format as one that "represents datasets, models, and configurations for AI and machine learning systems." SPDX 3.0 includes AI and Dataset profiles; the specification says the Dataset Profile "captures the relevant information about the datasets used in an AI system or other applications." In May 2026, CISA and its G7 partners released joint guidance on the minimum elements of a software bill of materials for AI, which CISA describes as recommendations that are "not exhaustive or mandatory."

A bill of materials describes what a system is made of. The inventory adds who owns it, what it may touch and who may use it. An enterprise that keeps both should link them by a common identifier.

ISO/IEC 42001:2023 is the AI management system standard. NIST's crosswalk, drawn against the final draft of the standard, maps GOVERN 1.6 to its guidance on documenting data, tooling, system and computing, and human resources for AI systems. The [ISO/IEC 42001](https://aperion.ai/glossary-iso-iec-42001/) glossary entry summarizes the standard.

## Five places to look

No single system holds the whole estate. A first inventory draws from five sources and reconciles them.

1. **Contracts and procurement.** Every agreement with a model provider, and every SaaS contract whose product now carries AI. The contract names the vendor and the terms, and sometimes the models.
2. **Identity and credentials.** API keys, service accounts and OAuth clients issued for model providers and agent platforms.
3. **Cloud accounts and hosting.** Model endpoints, GPU instances and container images in the accounts the enterprise controls. This is where owned models live.
4. **SaaS administration.** The admin console of each major platform, where AI features are switched on or off and where agent builders publish their work.
5. **The traffic itself.** Calls from applications and agents to models and tools. Traffic shows what runs, including what nobody filed.

The first four sources show intent: what was bought, issued or built. The fifth shows behavior. Reconciling them surfaces the gaps: a credential with no contract, a contract with no traffic, traffic to a model no one approved. The [shadow AI guide](https://aperion.ai/blog/enterprise-shadow-ai-guide/) covers the last kind.

MCP servers deserve a separate pass. The Model Context Protocol gave tools a common interface, and its specification states that "MCP itself cannot enforce these security principles at the protocol level," leaving consent and access control to implementors. The official MCP Registry, launched in preview on September 8, 2025, is "an open catalog and API for publicly available MCP servers". A public catalog lists what exists. The enterprise inventory lists which of those servers its agents call, under whose authority, and with what data. The [MCP security](https://aperion.ai/glossary-mcp-security/) entry covers the risks on that path.

## Why inventories go stale, and how to keep them current

An inventory taken once describes a single day. Three things move it.

**Providers change models on their own schedule.** OpenAI's deprecations page lists the August 2025 snapshot of GPT-5, gpt-5-2025-08-07, for shutdown on December 11, 2026, and defines shutdown as a model that "is no longer accessible." Anthropic gives at least 60 days' notice before it retires a publicly released model, and requests to a retired model fail. A line that records the model version and its retirement date surfaces the change weeks ahead. A line that says only the provider's name does not. Providers also update models in place, which the glossary covers under [model drift](https://aperion.ai/glossary-model-drift/).

**Governments can switch models off.** On June 12, 2026, Anthropic disabled Fable 5 and Mythos 5 for all its customers to comply with a U.S. government export control directive, and said it would begin restoring access on July 1 after the Commerce Department removed the controls. An inventory that names a [permitted alternative](https://aperion.ai/glossary-model-allowlist-and-denylist/) for each workload turns that event into a planned switch.

**Teams add AI faster than any review cycle.** Agents arrive on the platforms teams already use, and SaaS features arrive with renewals. An annual review, the floor M-25-21 sets for federal agencies, leaves most of a year between snapshots.

The answer is an inventory fed by the call path. An inventory drawn from the traffic itself stays current as teams add models. Reconciled against contracts and credentials, the traffic record becomes the governed inventory. The [AI control plane guide](https://aperion.ai/blog/ai-control-plane-enterprise-guide/) covers where that enforcement point sits.

Agents need one more maintenance step. When the person whose authority an agent uses changes roles or leaves, the agent's authority has to change with them. Our post on [agents as employees](https://aperion.ai/blog/ai-agents-as-employees-joiner-mover-leaver/) applies the joiner, mover and leaver process to agents.

## A first inventory in five steps

1. **Set the scope.** Every model, agent, tool and MCP server, rented or owned, including AI inside SaaS tools. Leave nothing out because it is small.
2. **Pull the four intent sources.** Contracts, credentials, cloud accounts and SaaS admin consoles, into one list with one row per entry.
3. **Read the traffic.** Compare what calls models and tools against the list. Add what is missing and flag what never runs.
4. **Assign an owner to every line.** A named person who confirms the purpose, the data classes and, for agents, the authority. A line with no owner after a set period is escalated, and an agent with no owner is suspended.
5. **Tie the inventory to policy.** Each line points to the policy that governs it: which teams may call it, which data it may receive, which actions need approval. Review lines with a retirement date or an ownership change first.

## Questions the inventory should answer

- How many models does the enterprise call today, rented and owned, and who owns each one?
- Which agents act on a person's authority, and whose?
- Which MCP servers do agents call, and which of them handle customer data?
- Which models have a published retirement date in the next six months, and what replaces each one?
- Which SaaS products switched on AI features since the last review?
- If an examiner asks which model saw a customer's data, how many systems do you query to answer?

## How APERION approaches the inventory

Owned intelligence, governed from the first call. APERION future-proofs the hybrid AI estate: every agent and every model an enterprise rents or owns, governed from one control point inside its own walls. The thesis is set out on [AI governance](https://aperion.ai/ai-governance/).

The control point sits in the path between agents and every model and tool they call, rented or owned, and keeps each action inside the authority a person delegated. Each record names the person, the agent, the model and its version, the provider, the policy that applied and who approved any exception. Global policy. Local enforcement. Portable evidence.

The [Trust Fabric](https://aperion.ai/blog/trust-fabric/) sets out the four layers underneath: verified identity, access governance, runtime governance, and audit and evidence.

A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.

## Frequently asked questions

### What is an AI inventory?

An AI inventory is a list of every model, agent, tool and MCP server an enterprise uses, rented or owned, with a named owner on every line. Each line records where the model runs, the provider and version, the data classes it may reach and, for an agent, whose authority it uses. It is the list every other AI control depends on, from policy to approval to evidence.

### What is the difference between an AI inventory and an AI bill of materials?

An AI bill of materials describes what a system is made of: models, datasets, configurations and dependencies, in formats such as CycloneDX ML-BOM or the SPDX 3.0 AI and Dataset profiles. An inventory describes how the enterprise uses each system: who owns it, what data it may touch, who may call it and which policy applies. An enterprise that keeps both should link them by a shared identifier.

### Do banks have to include generative AI in the model inventory?

SR 26-2 expects an effective model inventory for the models it covers, and its footnote 3 places generative and agentic AI models outside the guidance's scope. It directs banking organizations to their own risk management and governance practices for systems the guidance does not cover. Keeping language models and agents in the same inventory as other models gives one record for an examiner instead of two.

### How often should an AI inventory be updated?

Continuously where possible. Providers retire model versions on published schedules, teams add agents on platforms they already use, and SaaS renewals switch on new AI features. An annual review, the minimum the federal M-25-21 memo sets for agencies, leaves long gaps. An inventory fed by the traffic on the call path, reconciled against contracts and credentials, stays closer to what runs.

### Should MCP servers be in the AI inventory?

Yes. MCP servers are the tools agents call, and the MCP specification leaves consent and access control to implementors because the protocol cannot enforce them itself. The inventory should list each server agents use, who runs it, which agents may call it, which arguments are allowed and what data comes back. A public registry lists servers that exist; the inventory lists the ones in use.

### Who should own each line of the AI inventory?

A named person who can answer for the entry: its purpose, the data it reaches and, for an agent, the authority it uses. Teams and cost centers cannot answer an examiner. When that person changes roles or leaves, the line moves to a new owner, and an agent acting on the departing person's authority is re-scoped or suspended until someone accepts it.

## Sources

- NIST, [Artificial Intelligence Risk Management Framework (AI RMF 1.0)](https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf), NIST AI 100-1, January 2023\. Opened October 21, 2026.
- NIST, [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), revision status. Opened October 21, 2026.
- NIST, [NIST AI RMF to ISO/IEC 42001 Crosswalk](https://airc.nist.gov/docs/NIST%5FAI%5FRMF%5Fto%5FISO%5FIEC%5F42001%5FCrosswalk.pdf). Opened October 21, 2026.
- ISO, [ISO/IEC 42001:2023, Artificial intelligence: Management system](https://www.iso.org/standard/42001). Opened October 21, 2026.
- Board of Governors of the Federal Reserve System, OCC and FDIC, [SR 26-2, Revised Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf), April 17, 2026\. Opened October 21, 2026.
- Office of Management and Budget, [M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust](https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf), April 3, 2025\. Opened October 21, 2026.
- Nextgov/FCW, [Agencies report over 3,000 AI use cases in 2025](https://www.nextgov.com/artificial-intelligence/2026/04/agencies-report-over-3000-ai-use-cases-2025/412898/), April 16, 2026\. Opened October 21, 2026.
- EU Artificial Intelligence Act, [Article 26, Obligations of deployers of high-risk AI systems](https://artificialintelligenceact.eu/article/26/). Opened October 21, 2026.
- Official Journal of the European Union, [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj), July 24, 2026\. Opened October 21, 2026.
- OWASP CycloneDX, [Introducing OWASP CycloneDX v1.5](https://cyclonedx.org/news/cyclonedx-v1.5-released), June 26, 2023, and [Machine Learning Bill of Materials (AI/ML-BOM)](https://cyclonedx.org/capabilities/mlbom/). Opened October 21, 2026.
- SPDX, [System Package Data Exchange (SPDX) Specification, Version 3.0.1](https://spdx.dev/wp-content/uploads/sites/31/2024/12/SPDX-3.0.1-1.pdf). Opened October 21, 2026.
- CISA, [CISA and G7 Partners Release Joint Guidance on the Minimum Elements of a Software Bill of Materials for Artificial Intelligence](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/416bd74), May 12, 2026\. Opened October 21, 2026.
- Model Context Protocol, [Specification](https://modelcontextprotocol.io/specification/latest), version 2026-07-28, and [Introducing the MCP Registry](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/), September 8, 2025\. Opened October 21, 2026.
- OpenAI, [Deprecations](https://developers.openai.com/api/docs/deprecations), OpenAI API documentation. Opened October 21, 2026.
- Anthropic, [Model deprecations](https://platform.claude.com/docs/en/about-claude/model-deprecations), Claude Platform Docs. Opened October 21, 2026.
- Anthropic, [Statement on the US government directive to suspend access to Fable 5 and Mythos 5](https://www.anthropic.com/news/fable-mythos-access), June 12, 2026\. Opened October 21, 2026.
- Al Jazeera, [US lifts restrictions on Anthropic's powerful AI models Fable and Mythos](https://www.aljazeera.com/economy/2026/7/1/us-lifts-restrictions-on-powerful-ai-models-fable-mythos-anthropic-says), July 1, 2026\. Opened October 21, 2026.

## Related reading

- [Enterprise shadow AI guide](https://aperion.ai/blog/enterprise-shadow-ai-guide/)
- [What is an AI control plane?](https://aperion.ai/blog/ai-control-plane-enterprise-guide/)
- [How to govern AI agents across platforms](https://aperion.ai/blog/govern-ai-agents-across-platforms-guide/)
- [AIDA: agent identity guide](https://aperion.ai/blog/aida-agent-identity-guide/)
- [AI agents as employees: joiner, mover, leaver](https://aperion.ai/blog/ai-agents-as-employees-joiner-mover-leaver/)
- [The Trust Fabric](https://aperion.ai/blog/trust-fabric/)