What is a system of record for AI compliance?
A system of record for AI compliance is the single authoritative source for all AI governance data: the complete inventory of AI systems, their risk classifications, actor roles, obligation mappings, evidence states, approval decisions, and audit trails.
It is where the truth lives. When different teams, tools, or processes produce conflicting information about an AI system's compliance state, the system of record is the authoritative source. Without one, governance data is scattered across spreadsheets, email threads, and isolated tools — and no one can answer with certainty how many AI systems the organisation operates or what their governance state is.
Key points
- A system of record is not a report or a dashboard. It is the underlying data layer that all reports, dashboards, and governance activities draw from.
- It must be complete: every AI system the organisation operates must be registered. Unregistered systems are ungoverned by definition.
- It must be current: the governance state must reflect the latest screening, evidence, approval, or re-screening — not the state from the last compliance project.
- It must be authoritative: when the system of record says a system is approved, that is the definitive governance state. There is no separate "real" status elsewhere.
- It must be accessible to all governance roles: system owners see their systems, supervisors see their portfolios, auditors see read-only records, executives see aggregate state.
Why it matters
Without a system of record, the first audit question — "show us your AI inventory and its governance state" — cannot be answered reliably. Multiple spreadsheets, different team records, and informal tracking create conflicting truths. A system of record eliminates this by providing one source that everyone works from and that the audit examines.
How EAB approaches this
EAB's AI System Registry is the system of record. Every AI system, every governance action, every evidence artefact, every approval decision exists in one place. The Executive Cockpit provides portfolio-level views. Auditor Visibility provides read-only access. The system of record spans AI Act, GDPR, and NIS2.