What an AI Use Case Inventory Is
An AI use case inventory is a structured record of every AI system, tool, or agent in active use across a district's instructional, administrative, and operational functions. It differs from a general software list in what it captures: not just that a tool exists, but what it is used for, what data it can access, who deployed it, and which user groups interact with it.
NIST's AI Risk Management Framework frames this as part of its Map function, which recommends characterizing AI systems as a prerequisite to identifying risk. A district cannot assess or manage risk in a tool it has not formally documented, and it cannot answer basic oversight questions, such as which systems touch student PII, without a consolidated record to check against.
Why Districts Need One
AI tools enter districts through many channels at once: curriculum teams piloting instructional apps, administrative staff adopting scheduling or grading assistants, individual teachers signing up for free tools without going through procurement. Each of these introduces a system with its own data access footprint, but without central tracking, no single office has a complete view of what is running or what data it touches.
This creates specific exposure. FERPA obligations attach whenever a tool accesses student personally identifiable information, regardless of whether the tool went through formal procurement. A vendor tool that added generative AI features after initial approval may now process data in ways the original review never considered. During a data privacy audit, vendor risk review, or public records request about AI use, a district without a maintained inventory has no reliable way to respond.
Fields a Use Case Inventory Should Capture
At minimum, each entry should document the attributes that make AI systems governable rather than merely catalogued:
- Purpose of the use case (instructional, administrative, or operational)
- Vendor or provider, and whether generative AI features are present
- Deploying department and accountable owner
- Data access scope, including student and staff PII
- Integration method (LMS, SSO, API, standalone signup)
- User population and groups that interact with the system
- Risk classification based on data sensitivity and function
Building the Inventory in Practice
Ownership, governance, and scope
District IT or data governance leaders typically own the inventory, since it intersects directly with existing IT asset management, procurement, and vendor data privacy agreement processes. NIST AI RMF's Govern function calls for organizations to assign clear accountability for AI risk decisions, and districts should reflect this by naming a single owner responsible for sign-off on new entries rather than leaving the inventory to informal, department-by-department tracking.
This ownership question also determines scope. An inventory limited to procured software will miss tools adopted directly by staff. Extending discovery to LMS and SSO connected-app logs, and reviewing what data an integration is actually permitted to access at runtime rather than what a vendor claims, gives a more accurate picture of exposure than a static list of approved vendors alone.
Guidance from groups like TeachAI and CoSN increasingly points districts toward maintaining registries of approved AI tools, though the required level of detail varies by state and is not uniformly mandated.