The Regulators Already Assume You Have an AI Inventory. Do You?
Brief
The regulators are done with “Trust as policy”.
That chain used to be an internal maturity problem, something a security program could work on over time:
A developer trusts AI-generated code because it compiles. A reviewer trusts an AI-generated summary because it reads plausibly. A security team trusts scanner output because the pipeline shows green. An auditor trusts the evidence because the checklist is complete. At no point does anyone verify the thing itself. Each person is only confirming that the step before them looked fine.
It isn’t anymore. The EU AI Act, the Cyber Resilience Act, NIS2, and DORA all now assume, or require, documented inventory and demonstrable oversight of AI-enabled systems. ISO 42001 turns that baseline into an actual management system with ownership, risk assessment, lifecycle controls, monitoring.