What AI assets should I document and inventory?

Answered

Maintain a comprehensive inventory of AI assets and interdependencies, and keep an audit trail of system design, data/models/prompts, and post-deployment maintenance plans.

From the guidance

Primary (how) Code of Practice for the Cyber Security of AI

Developers, Data Custodians and System Operators shall maintain a comprehensive inventory of their assets (including their interdependencies/connectivity).

Section: Principle 5: Identify, track and protect your assets

Read this in Code of Practice for the Cyber Security of AI (opens in new tab)

Primary (how) Code of Practice for the Cyber Security of AI

Developers shall document and maintain a clear audit trail of their system design and post-deployment maintenance plans.

Section: Principle 8: Document your data, models and prompts

Read this in Code of Practice for the Cyber Security of AI (opens in new tab)

Related questions

• How do I keep an inventory of AI systems in my organisation?
• Which AI assets should I protect, including logs? Security and safe use of tools
• Should we document AI models with model cards or SBOMs?
• Should we monitor AI system inputs as well as outputs?
• How should I decommission AI models and training data?