Guide 01 · Step 2 of 5

Inventory and classify

This is the step that decides whether the whole programme works, and it is also the easiest one to do badly.

Independent guidance from Synergy. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. Always work from the published text of the standard.

Build one register. One row per AI system or agent, including anything embedded in software you bought.

Eight columns is enough. Resist adding more until you have used it for a quarter.

Four rules that make the difference:

1. Every row has a named business owner. Not a department. A person. If nobody will own a row, that is a finding, not a gap to fill later.
2. "Criticality" means: what happens if this system is wrong? Not how important it feels. Rank by consequence.
3. Include the shadow systems. The personal ChatGPT account used for customer emails counts. You cannot govern what you refuse to see.
4. Date every row. An undated register is a historical document.

Then classify the data. Four levels is enough: public, internal, confidential, regulated. Map each system to the highest level it touches.