How Do We Create and Maintain an AI Tool Inventory for Our Health System?

Why Most Health Systems Undercount Their AI Footprint

When health system leaders are asked how many AI tools their organization is running, the first estimate is almost always low. Not because anyone is hiding anything, but because the question is harder to answer than it sounds.

Standalone AI products that went through a formal procurement process are relatively easy to see. The AI scribe a clinical department has been piloting, the sepsis prediction tool an ICU adopted, the revenue cycle optimization platform a CFO approved. Those tend to be visible because they had a buying decision attached to them.

What gets missed are AI features embedded within enterprise software the organization already runs. An EHR almost certainly has AI-assisted documentation, predictive risk scoring, or AI-enhanced imaging reading built into modules that were licensed years before anyone was asking governance questions about AI. A billing platform may have machine learning-driven claim prioritization running continuously in the background. These aren't new purchases. They arrived through software updates, often without triggering any governance review, and they're rarely top of mind when someone asks about AI use.

The AMA is explicit on this point: governance working groups should ask department heads to inventory AI tools including AI features embedded within existing enterprise technology. That's the gap where most inventories fall short.

Define "AI Tool" Before You Ask Anyone to Report

The most common reason AI inventories fail before they start is definitional ambiguity. If you ask department heads to report their AI tools without giving them a shared definition, you'll get wildly inconsistent results. One department head will list only FDA-cleared clinical decision support tools. Another will include every software product with a chatbot feature. A third will omit the consumer generative AI tools their staff use informally because those weren't officially approved.

Before any survey goes out, your governance working group needs to agree on a definition that department leaders across the organization can apply consistently. A working definition should cover: predictive and statistical models, classical machine learning, generative AI including large language models, AI features embedded within existing enterprise platforms such as EHRs and imaging systems, and consumer AI tools staff may be using in workflows even without formal approval.

This definition doesn't need to be perfect. It needs to be specific enough that the people responding understand what to include and what to leave out. You can refine scope in subsequent inventory cycles once the baseline is established. The AMA guidance is explicit that this shared definition is foundational to getting complete coverage, and that organizations should incorporate the inventory into a standard management tool rather than maintaining it informally.

What to Track for Each Tool

The HHS FY25 AI Use Case Inventory provides a practical, field-tested data model. For each tool in your inventory, the following fields capture what you need for governance, monitoring, and regulatory preparedness.

The goal isn't to fill in every field for every tool on day one. A partially complete inventory is significantly more useful than no inventory. Start with the fields you can answer quickly, flag the gaps, and build a process to fill them over time.

Categorizing What You Find by Risk Level

Once you have an initial catalog, sort it by risk level. Clinical tools that influence patient care decisions carry different governance obligations than tools managing scheduling, supply chain, or administrative workflows. A practical three-tier framework.

What to Do with Tools Discovered Without Formal Approval

You will find them. Departments that moved quickly, vendors who rolled out AI features quietly through platform updates, staff using consumer generative AI tools in daily workflows. The inventory process should not be framed as an audit designed to penalize anyone for using technology that was helping them do their jobs.

The AMA's guidance is explicit on framing: the inventory effort is meant to catalog successful use cases, identify future opportunities, and ensure compliance with applicable law, not to challenge existing activity. That framing matters because it determines whether department heads are honest with you or protective of their teams. An inventory effort perceived as punitive will produce an incomplete inventory.

Tools discovered without prior approval should be assigned to an "under review" category. High-risk clinical tools in that category need expedited governance review. Lower-risk administrative tools can move through a standard review queue. What they can't do is remain in limbo indefinitely with no named owner and no review timeline.

Keeping the Inventory Current

An AI tool inventory that's twelve months out of date is a liability more than an asset. The AI deployment environment in most health systems is changing faster than annual review cycles can track.

Practical approaches to continuous maintenance include tying inventory updates to vendor contract review cycles, requiring that any new AI tool deployment or vendor-pushed AI capability update triggers a notification to the inventory owner, including AI inventory status as a standing item in department leadership meetings, and assigning a named inventory owner with clear authority to query vendors and department heads when changes are suspected.

At enterprise scale, human-only review processes break down. HIMSS 2026 guidance framed this as "using technology to govern technology": deploying tools for governance inventory and model monitoring rather than relying solely on manual review. Organizations building governance infrastructure for larger AI portfolios should be evaluating purpose-built governance tools rather than maintaining a growing inventory in a spreadsheet.

The inventory is also directly relevant to HTI-5 preparedness. Regulatory analysis of HTI-5 calls for health systems to inventory existing AI-enabled tools and workflows with specific attention to tools subject to transparency requirements and to review vendor contracts for transparency, monitoring, notification, and validation provisions. Starting the inventory now creates the foundation for that compliance work before regulatory deadlines arrive.

What the Inventory Enables — and Doesn't Resolve

A complete, maintained tool inventory tells you what AI is running in your organization. That's a necessary starting point. It's not a sufficient governance posture on its own.

The governance question the inventory enables — but doesn't answer — is which decisions AI influences, at what consequence level, and with what human-in-the-loop status. Those are different questions than what tools are we running.

Most governance gaps that become visible during surveys or adverse events aren't inventory failures. They're decision accountability failures. A tool that's properly catalogued but governs a high-stakes clinical decision without named executive oversight is still exposed. The inventory shows the tool exists. It doesn't show whether anyone is responsible for what that tool decides.

The next layer of governance — mapping AI by the decisions it influences rather than by the tools themselves — is what board reporting and survey preparation ultimately require. The inventory makes that analysis possible. It doesn't substitute for it.

Frequently Asked Questions

Common questions from health system leaders building or improving their AI tool inventories.