An AI Inventory Needs a History

In short: an AI inventory that only shows each system's current answers cannot tell you who owned a system last spring, why its risk tier dropped, or whether a blank field means nobody knows the answer or somebody chose not to share it. Keep a change log beside the inventory. Each entry should preserve the prior and new values under a stable system ID, with the effective date, who made the change, the owner, the reason, the evidence, the approval and the retest trigger.

This resource builds on What Is an AI Inventory? and gives you a reusable change log, a fictional reclassification record and a portfolio assignment for governance operations, QMS and audit roles.

What the Federal Inventory Research Found

A research preprint posted on November 3, 2026 by Dipto Das, Syed Ishtiaque Ahmed, Aditya Vashistha and Shion Guha linked entries across three releases of the US Federal AI Use Case Inventory [1]. The inventory grew from 710 entries with 10 fields in 2023 to 2,133 entries with 62 fields in 2024 and 3,611 entries with 36 fields in 2025. Fewer required answers were left blank over time. Even so, the authors found that tracking accountability got harder, for three reasons they describe: each release redrew the questions, agency-assigned classifications decided which entries had to answer the governance questions, and answers were overwritten from one release to the next.

Two details stand out for anyone who maintains an inventory. Reclassifications that took a use case out of the categories requiring governance answers were the least explained of all (Section 4.2.1 of [1]). And a detailed answer in one release could become a blank in the next, with nothing to show whether the system changed or only the record did.

The authors recommend that the inventory preserve its own history: persistent identifiers, links for renamed, merged or split entries, a change log of questions and answers, and, whenever a use case crosses into or out of a higher-risk category, a record of the previous and new categories, the responsible office, the evidence and what changed. They also recommend distinguishing kinds of missing answers. These are research recommendations to OMB and federal agencies. They are not new federal requirements, and the paper does not say any agency has adopted them.

What Each Change Log Entry Records

Two rules make it work. Entries are appended, never edited; a mistaken entry gets a correcting entry that points back to it. And the current inventory must always match the latest entry for each field, which is easy for an auditor to test.

Missing, Not Applicable and Withheld Are Different

A blank cell hides at least three situations. Give each field a status as well as a value.

A change from Missing to Not applicable is a decision and needs a rationale. A change from an answer to Missing needs an explanation too, because it usually means either a record error or something that stopped being checked.

A Fictional Reclassification Record

Everything below is fictional. Crestline and its people were invented for this exercise.

The fictional Crestline Housing Authority keeps system AI-0042, a vendor tool that scores incoming maintenance requests by urgency. Over six months it changes owner, gains a new use and is reclassified.

The record also logs one field status change. The vendor's training data description moved from Missing to Withheld on June 12: the vendor supplied it under a confidentiality agreement, the procurement lead holds it, and the committee chair and internal audit may read it. The public summary of AI-0042 now says the description exists and is withheld, rather than showing a blank.

Notice what the history lets a reviewer do. Without it, the current inventory would show a Tier 1 system owned by Resident Services and nothing else. With it, anyone can see that the tier rose because the use changed, when it changed, and which new controls the change set off. If the relocation flag were later dropped and the tier went back to 3, the log would show that as a use-case change with its own approval, not as a quiet edit.

Who Keeps the History

Governance operations staff log changes, chase missing fields and make sure every reclassification has a rationale and an approver. QMS staff treat the inventory as a controlled record, with document control, review dates and corrective action when the log and the inventory disagree. Internal audit samples entries, traces each one to its evidence and approval, and tests whether systems moved to lower tiers had a valid reason. The evidence documentation skills guide and the governance program management skills guide cover the related skills.

Portfolio Assignment

Build a five-system fictional inventory and a change log for it. Log at least one owner change, one use-case change, one risk reclassification that depends on the use-case change, and one record correction. Use all three field statuses (Missing, Not applicable, Withheld) at least once, with reasons. Then switch roles: as an auditor, pick two entries, trace them to their evidence and write one finding about a gap you planted. Label everything fictional and keep it to a spreadsheet and a one-page note.

Interview Question

"Last quarter, one of our AI systems moved from high risk to low risk in the inventory. How would you tell whether that was a real change, a change in our criteria or a data entry error?"

Indicators of a strong answer:

• Goes to the change history first, and asks what to do if there is none.
• Separates a change to the system or its use from a change to the classification criteria and from a record correction.
• Asks who approved the reclassification and whether they had the authority to.
• Checks whether controls tied to the higher tier were switched off, and when.
• Treats an unexplained move to a lower tier as a finding, not a formality.
• Knows the difference between a blank, a not-applicable answer and a withheld one.

Sources and Free Learning

[1] Dipto Das, Syed Ishtiaque Ahmed, Aditya Vashistha and Shion Guha, "Palimpsestic Accountability in the US Federal AI Inventories," arXiv preprint 2611.04153, version 1, submitted November 3, 2026. https://arxiv.org/abs/2611.04153
A research preprint with free full text. Read the findings on reclassification and overwriting in Section 4 and the recommendations in the discussion. The recommendations are the authors' proposals, not federal policy.

[2] National Institute of Standards and Technology, AI Risk Management Framework page. https://www.nist.gov/itl/ai-risk-management-framework
Free. AI RMF 1.0 (January 26, 2023) is voluntary. Its GOVERN 1.6 subcategory reads: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities" (NIST AI 100-1). NIST's page says the framework is being revised; no new edition had been released when we checked on November 7, 2026.

The change log, the field statuses, the assignment and the interview question are GRC Careers editorial recommendations. Crestline Housing Authority and everything in its record are fictional.