Identification of assets and their value

The organization should identify the assets an AI system involves or affects and their value: assets of value to the organization, assets of value to individuals and assets of value to society, so that the harm a risk can do is judged against what is at stake for each. The step before 6.4.2.2 supplies its input, so run both together.

What it asks

The organization should identify the assets an AI system involves or affects and their value: assets of value to the organization, assets of value to individuals and assets of value to society, so that the harm a risk can do is judged against what is at stake for each.

Where generative AI changes the answer

The assets include the prompts, the retrieval corpus, the evaluation sets and any fine-tuned weights, none of which look like an asset in a classic register.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.2 the named role is the owner of asset and value inventory for each AI system across organization, individuals and society.

Evidence an auditor normally samples

• Asset and value inventory for each AI system across organization, individuals and society

The test you can run

Ask for asset and value inventory for each AI system across organization, individuals and society and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Assets valued to the organization only

Before the draft publishes

For 6.4.2.2, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is asset and value inventory for each AI system across organization, individuals and society.

Where this sits against the draft

6.4.2.2 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.2 (identification of assets and their value) with this record and note the change in the register.