AIG-01 · AI and Automated Decisions
AI system inventory
AI and automated decision systems in use are inventoried with purpose, owner, data and risk classification.
2frameworks fully address it
2partially
4leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2Absent No AI-specific criteria; AI systems are treated as any other system.
- ISO 27001Absent Annex A is technology-neutral; ISO/IEC 42001 addresses AI management systems instead.
- NIST CSFPartialID.AM-01 Through asset inventory.
- PCI DSSAbsent Out of scope.
- HIPAAAbsent Out of scope.
- GDPRPartialArt. 22, 30 Automated decision-making records where applicable.
- EU AI ActFullArt. 6, 49
- NIST AI RMFFullMAP 1.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
AI inventory, classification records, owner assignment.
?Why it exists
You cannot govern models you have not listed, including the ones staff adopted quietly.
For a smaller organizationOne list including the tools people already use.