AI Inventory: Why an All-Green List Is a Warning

Human in Charge is a weekly newsletter about how businesses actually use AI and who stays in control. This week, a fractional Head of AI in Miami who builds the reporting that wealth firms put their name on.

A quarterly report lands in an inbox. Twelve pages, a cover note, a table of positions, and a performance figure near the top that somebody is going to read out loud on a call next week.

You read the number. You believe it.

There is nothing in the document that tells you where it came from, because there never is. Somebody pulled it from a system, or from a spreadsheet that pulls from a system, or typed it from a spreadsheet that somebody else pulled from a system. At some point a person looked at it and decided it was right.

That chain is invisible by design. It is invisible when it works, and it is invisible when it does not, which is a problem.

Now put an AI model somewhere in it. Nothing dramatic, nothing deciding anything. Just helping. Drafting the commentary, summarising the quarter, pulling the figures together so a human can check them faster.

Meet Ignacio Lopez

Ignacio Lopez is a fractional Head of AI in Miami. He builds for family offices, wealth managers, real estate developers who report to investors, and owner-operated companies, in English and Spanish, on fixed-fee engagements that run four to sixteen weeks.

Three companies founded. Product leadership for B2B software sold to IT teams. Before that, JP Morgan, KPMG and a Palo Alto innovation lab.

We send everyone in this series the same eight questions. He opened his reply by declining two of them, on the record, before answering any of the rest.

“I am in the United States serving US and Latin American clients, so the AI Act does not apply to me. I will not pretend to a view on how its enforcement plays out.”

Most people in his position would have answered both anyway. That he did not is the reason the rest of it is worth printing.

The rule that comes before the tools

We asked him what AI actually does in his work and the list is unglamorous. Document extraction and classification. First-pass drafting. Summarising material he has already read. Code.

Then there is one boundary that sits above all of it.

“The model has no authority over any number. Not a threshold it works under. None at all. Figures come out of deterministic code and the model writes the sentences around them, because a wrong number reads exactly like a right one.”

That is the reverse of how most teams adopt AI. The usual path is to let the model help with a bit of everything and then watch for mistakes. His is to decide in advance which part of the work the model is structurally unable to touch, and then let it run freely everywhere else.

Numbers come from code and the AI writes the sentences around them. A person makes the judgment and signs at the end.

At one multi-family office he built for, the reporting comes out of that stack and is reviewed and signed by the firm’s compliance officer. Everything upstream of that signature exists so the officer can put their name to the figures without taking them on faith.

The gap he now looks for

“The person who chose the tool is almost never the person now accountable for it. A team adopts something because it solved a problem that week. Accountability gets assigned months later, to someone who was not in the room. That gap is where most of the governance work I get called into actually sits.”

A team had a problem in March and solved it. In September somebody senior was told they own AI, and inherited a set of decisions made by people who were solving something else entirely.

The list that shows red

He keeps a record of every automated process he runs, what it touches, and what it is allowed to do. He maintains it himself, with no title attached, because there is nobody else.

“That record is currently telling me an evaluation I committed to has never been run, one monitoring list is entirely out of date, and a document pointer is broken. That is the register working.”

Three open faults, volunteered to a stranger writing a newsletter, by the only person responsible for fixing them.

“A record that only ever shows green is not being maintained. It is being decorated. So when you ask a company for their AI inventory and every line looks current, the question to ask next is when any item in it last changed.”

Our own study of 53 small companies found that half keep a written record of where AI is used. But are they up to date? On his account, that is the question that separates a list from a wall decoration.

Three questions before anything touches client work

Before client data goes near a tool, he runs the same check. Can this data legally go into a US cloud AI tool. Is there an NDA, a regulator, an employer policy or a security constraint in the way. Where does the data physically live, and what device does the work require.

“If the first answer is no, I do not build the engagement on that data. I scope to something else rather than argue about it.”

What regulated clients actually ask

“Where is this processed. How long is it retained by default, not by policy. Is it used for training. Can you produce a data processing agreement. Who at your end can see it.”

Five questions, and a policy document answers none of them.

“It is answered by reading the vendor’s own terms for the specific plan you are actually on, which almost nobody does.”

In our study, 59% of companies had already been asked about their AI use by a client, customer or partner. His version tells you what the second email looks like, once the policy PDF has been sent and has settled nothing.

Where he was wrong, twice

He volunteered to tell us this as well.

“Retention defaults. I have been wrong about them twice. Paying for a business tier does not by itself stop your content being used for training, and the defaults are not uniform across a single vendor’s own products. One surface kept material far longer than I had assumed. Another had no ceiling at all until it was configured.”

And again on a regulatory provision, which he cited incorrectly twice in his own compliance notes before someone made him trace it back to the source text.

“Both are the same failure. I trusted a summary of a rule instead of the rule.”

What he landed on is a dating convention rather than a resolution to be more careful. Record which version of the rules a conclusion was checked against, then re-check once that version moves.

“If a company cannot tell you which version of a vendor’s terms their assessment was made against, the assessment is undated, and an undated assessment is not evidence of anything.”

The date he raised unprompted

He does not fall under the EU AI Act and said so in his first paragraph. He still sent us this in October, while the piece was being written.

“Article 50(4) lets a deployer skip the AI label on text published to inform the public on matters of public interest when a person reviewed it and holds editorial responsibility. That is your newsletter’s title written into the law. The step I see skipped most is the record of who reviewed it and what they changed.”

He also flagged 2 December 2026, the date by which providers of generative systems already on the EU market before 2 August 2026 have to add machine-readable marking to what those systems produce. That date belongs to the vendors. A company that only uses AI was given no extension at all, and its own obligations started in August. We wrote about who that deadline actually hits separately.

What stays human

The numbers come from code, because a model cannot be trusted with them. The judgment comes from a person, because a model can draft but it cannot be accountable. And the record shows faults, because a record that never shows faults is not a record.

The arithmetic stays deterministic. The judgment stays human. The signature stays human.

Ignacio Lopez is founder of Work-Smart.ai, a fractional AI leadership practice in Miami building data layers, dashboards and AI systems for family offices, wealth firms and owner-operated companies.