Guide · Model Oversight · Risk, compliance, and IT leads
How to build an AI use case inventory at a bank or credit union
The fields an AI use case inventory needs, where to find the AI you didn't know you had, and how to keep the list current without a dedicated team.
You cannot govern what you have not listed. An AI use case inventory is the plain, unglamorous spreadsheet that every other AI control depends on: the policy points to it, vendor reviews feed it, the board report summarizes it, and an examiner asks for it.
The term now has a shared definition. The AIEOG AI Lexicon, released in February 2026 by Treasury and the financial sector, includes "AI use case inventory" among its defined terms. And the CSBS AI Supervisory Framework for state examiners names the AI inventory and use cases as one of its core review areas.
The fields that matter
Resist the urge to build a forty-column tracker. These ten fields answer nearly every question a committee or examiner will ask:
| Field | What to record |
|---|---|
| Use case | One sentence: what the AI does, in business terms |
| Business owner | A named person, not a department |
| Source | Built, bought (vendor name), or embedded in existing software |
| Tool or model | Product name and version if known |
| Data touched | Public, internal, or restricted customer/member data |
| Decision impact | Informs a person, drafts for review, or acts on its own |
| Customer-facing | Yes or no |
| Risk tier | Low, medium, high, or blocked (see below) |
| Human review | Who checks the output, and when |
| Status and dates | Proposed, approved, in use, retired; last reviewed |
Our use case inventory card is a ready-made version of this register. It splits a few of these fields further and adds a Blocked tier for uses your policy rules out.
Find the AI you didn't know you had
The first pass usually finds more than expected. Look in four places:
- Your vendor list. Ask each technology vendor in writing whether their product uses AI or machine learning, and what it does. Fraud, BSA/AML monitoring, document capture, and digital banking are the usual suspects.
- Release notes. Vendors are switching on AI features in routine updates. Someone should read them.
- Department heads. Ask each one what tools their team uses to write, summarize, or analyze — including free ones. Make it clear this is a census, not a disciplinary sweep, or you will not get honest answers.
- Expense reports and network logs. Subscriptions to AI tools on corporate cards, and traffic to AI sites, show what people actually use.
Tier the risk simply
Three working tiers, plus a Blocked label, are enough for a community institution:
- High — supports credit, fraud, BSA/AML, or complaint outcomes; uses customer or member nonpublic information (only in an approved private environment); or acts without a person reviewing first.
- Medium — produces customer-facing drafts or uses confidential internal information, with a person reviewing before release.
- Low — internal drafting and summarizing with public or internal information only.
- Blocked — any use the policy prohibits, such as customer information in a public tool. Record it so the decision is on file.
The tier sets the review: high-tier uses get documented testing, a second reviewer, and periodic re-review; low-tier uses get recorded and spot checked. CSBS publishes an optional AI Use Case Risk Tiering Worksheet with the framework if you want a more detailed structure.
Keep it alive
An inventory goes stale the month after it is built unless updating it is part of something that already happens. Attach it to three existing moments: new tool approval under your AI policy, vendor onboarding and renewal in your third-party program, and the annual policy review. Give one person ownership and a quarterly reminder.
What to do this month
Start the list with what you already know, even if it is five rows. Send the vendor letter. Name the owner. A short, honest inventory is worth more than a complete one that never gets finished — and it is the first document to have ready if your examiner asks.
Common questions
- What is an AI use case inventory?
- It is a list of every place the institution uses AI, whether built in-house, bought from a vendor, or embedded in software you already license. Each entry records what the AI does, who owns it, what data it touches, and how risky the use is. The financial sector's shared AI Lexicon, developed by Treasury with federal financial regulators and industry and released in February 2026, uses the term AI use case inventory.
- Is an AI inventory required?
- No federal rule requires one for community banks. But it is the first thing that makes every other AI control possible, and the CSBS AI Supervisory Framework that state examiners at state-chartered banks may use lists the AI inventory and use cases as a core review area.
- Do vendor AI features count?
- Yes. For many community institutions, much of their AI arrives inside vendor products: fraud scoring, document capture, chat features, core and digital banking add-ons. Those belong in the inventory with the vendor named as the provider.
- How often should the inventory be updated?
- Tie it to events rather than a calendar: every new tool approval, every vendor contract renewal, and every new AI feature a vendor turns on. A quarterly check by the owner catches what slipped through.