Know every AI model your business runs on, and prove it.
An AI model inventory for CISOs, heads of cybersecurity and security architects. See which models your applications, suppliers and teams use, flag the ones you have ruled out, and give your board and your customers a dated report.
In early access. Tell us which models or rules you need to answer for and we will scope it with you.
The models behind your business sit in more places than one team can see.
Applications, suppliers and teams call models hosted in many regions. The inventory records which ones you rely on, so a board or a customer gets one dated answer.
Why security teams choose it
One answer for the board
Which AI models do we depend on, and are any of them ruled out? Give a clear, current answer in place of a spreadsheet nobody trusts.
Shadow AI brought into view
Find the models your teams, products and suppliers use that nobody signed off, so you can approve, replace or retire them.
Evidence on request
A dated report you can hand to customers, auditors and supervisors when they ask what runs in your estate.
A fast answer when the rules change
When a customer, a regulator or a government names a model you must stop using, see where you use it and what to do next.
What you get
An AI model inventory
Every model in use, where it runs and who owns it.
A verdict on each model
Approved, review or flagged against your own policy.
Supplier visibility
Which of your suppliers' products rely on models you have ruled out, and the questions to put to them.
A dated attestation report
Its scope, date and findings stated, ready to share.
A route to fix it
Help to replace a flagged model and to check that quality holds.
Assurance that stays current
Regular refreshes, so your answer does not go stale.
Who is it for?
CISOs and heads of cybersecurity
Answer the AI question with evidence, for your board and your customers.
Security architects
Know which models are deployed and where, so you can design controls around them.
Risk, compliance and third party risk teams
Fill supplier questionnaires and AI governance registers with facts.
Suppliers to government and large customers
Answer "does your product use this model?" with evidence, not an email.
From first call to finished report
Scope
Tell us what you need to evidence, to whom, and which rules or customer requirements apply.
Assess
We map the AI models in use across your business and your suppliers.
Report
You receive your inventory, a verdict on each model and a dated report, plus a plan for anything flagged.
Before you start
- The report states what it covered, what it did not and how confident we are in each finding. It is an attestation, not a guarantee about every system in your company.
- Some use cannot be seen from company systems, such as AI on personal devices. The report says so.
- A model that runs inside a supplier's own service can only be confirmed with the supplier's help. Where it cannot be, the report marks it open.
- It does not need to see your prompts or your customers' data.
- It is not a legal opinion on whether a rule applies to you.
Questions about AI model inventory
What is an AI model inventory?
A current list of the AI models your business uses, in your products, your systems and your suppliers' services, with where each runs, who owns it and whether it is approved.
Is this the same as AI security posture management, shadow AI discovery or a CASB?
Those tools watch and control how AI is used. This answers a different question: which models are in use, and can you prove it. It can sit alongside them.
Why not just ask teams and suppliers?
You should, and we help you structure the questions. Answers from people are incomplete and go out of date quickly, and a questionnaire is not evidence. The inventory gives you something to check them against.
Does it find shadow AI?
It looks for AI use that is not on your approved list, across the areas we agree in scope, and says what it could not see.
Does it cover AI inside our suppliers' products?
Where it shows up in your own estate and with the supplier's help. Where it cannot be confirmed, the report marks it open and suggests the question to put to the supplier.
Do you need agents on our endpoints or changes to our network?
We agree what access is needed before we start. We aim to work from what you already have, with read-only access, and we do not sit in the path of your live traffic.
Does it read our prompts or customer data?
No. It does not need to.
Can it show open models running on our own GPUs?
Yes, if you want that in scope.
Does it help with ISO 42001, the NIST AI RMF, the EU AI Act or customer questionnaires?
It gives you the factual inventory those frameworks and questionnaires ask for. It does not certify compliance and it is not legal advice.
Which models can it flag, for example DeepSeek?
Whichever your policy rules out. Governments and customers have started naming particular models, and we flag whatever you list.
Is the report a certificate?
No. It is an attestation report that states its scope and date and says what we found in that scope. It does not claim to prove that nothing ruled out exists anywhere in your company.
How do we know the answer is complete?
The report says what was covered, what was not and our confidence in each finding. Where it is partial, we tell you, and we tell you what would close the gap.
Do UK firms have to keep an AI model inventory?
Not by a single UK rule that we can point to. Customers, suppliers and risk teams are asking the question, and frameworks such as ISO 42001 expect a register of AI in use. We will tell you if you do not need it.
How long does it take, and what does it cost?
We scope it with you first, agree a first milestone, then quote.
Related: Arithim Estate
Need a straight answer on which AI you run?
Tell us what you need to show and to whom. We will tell you what the inventory would cover and whether it is worth doing.
Book a scoping call →Prefer email? Write to hello@arithim.com.