AI Governance Institute
← News
Research2026-06-23

Municipal Algorithm Registers Offer Enterprise Compliance Teams a Practical Inventory Benchmark

What happened

CIDOB, the Barcelona Centre for International Affairs, published Part II: Case Studies of Urban AI Governance in February 2025, examining how municipalities across the EU are building algorithm governance programs. The paper details an algorithm lifecycle approach that structures governance across intake, risk assessment, deployment, audit, and retirement phases. A central feature of the model is the municipal algorithm register, a centralized repository that catalogs current and planned algorithmic systems, records their risk classifications, and publishes audit findings for high-risk systems. Mandatory audits are triggered by risk tier, and findings are disclosed through the register to enable public accountability. The research identifies these registers as tools for both internal management discipline and external transparency, addressing governance expectations that are increasingly reflected in regulatory frameworks such as the EU AI Act and national-level ADMT regulations.

Why it matters

  • ·Regulators across the EU, US, and Asia-Pacific are converging on requirements for documented, auditable AI system inventories, and the municipal register model demonstrates what a defensible, lifecycle-structured inventory program looks like in practice, raising the implicit standard against which enterprise programs may be assessed.
  • ·The mandatory audit requirement for high-risk systems tied to a public register introduces an operational precedent that enterprise compliance teams should anticipate in private-sector regulation, particularly under the EU AI Act's conformity assessment and fundamental rights impact assessment obligations for high-risk AI.
  • ·Organizations that rely on informal spreadsheets or ad hoc vendor lists as their AI inventory face material audit and disclosure risk as regulators, investors, and procurement counterparties begin expecting structured, lifecycle-oriented documentation of deployed AI systems.

Governance controls affected

SCT-009AI System Algorithm RegisterHOC-001AI System Risk ClassificationCMP-007EU AI Act Conformity Assessment and FRIA ProcessALC-002High-Risk AI Audit TrailMGV-002AI System Intake and Approval Workflow

What to do now

  • ☐Benchmark your current AI system inventory against the lifecycle register model described in the CIDOB research, specifically checking whether your inventory captures risk tier, audit status, and retirement dates for each system.
  • ☐Identify all high-risk AI systems in your inventory and confirm that mandatory audit triggers and audit documentation requirements exist for each, consistent with the register model and with EU AI Act conformity assessment obligations.
  • ☐Assess whether your current inventory and audit outputs are in a form that could be disclosed externally to regulators, auditors, or investors without significant remediation work.
  • ☐Review SCT-009 (AI System Algorithm Register) controls against the municipal register architecture to identify gaps in lifecycle coverage, particularly for intake approval, post-deployment audit, and deprecation records.
  • ☐Engage your legal and compliance functions to map the CIDOB register model to your specific regulatory obligations across jurisdictions, prioritizing EU AI Act, CPPA ADMT, and Colorado AI Act requirements.

What to watch next

Enterprise compliance teams should monitor whether EU member state regulators cite municipal register implementations as best practice evidence during EU AI Act enforcement proceedings, particularly as the August 2026 deadline for high-risk AI system obligations approaches. The European AI Office is expected to issue further guidance on conformity assessment documentation standards that may align closely with the lifecycle register architecture described in this research. Investor ESG disclosure frameworks and procurement counterparty due diligence questionnaires are also beginning to ask specifically about AI inventory completeness, suggesting that the register model may become a market expectation independent of formal regulation.

Stay ahead of stories like this

Get every EU AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-09

Credo AI Survey of 371 Leaders Maps Where Mature AI Governance Programs Pull Ahead

Credo AI released The State of AI Governance Report 2026, drawing on survey data from 371 senior leaders to benchmark where enterprise AI governance programs are advancing and where common gaps persist. The report identifies AI inventories, accountability structures, and review workflows as the controls that most differentiate mature programs from lagging ones. Compliance teams can use the findings to compare their operating models against peer practice and prioritize remediation.

Research2026-09-03

ISO 42001 Implementation Gap Exposed: Clause-by-Clause Guide Sets Audit Baseline

enz.ai has published a detailed implementation guide for ISO/IEC 42001:2023, covering each clause of the standard from scoping and leadership through internal audit and Annex A control mapping. The guide gives compliance teams a structured path for standing up a conformant AI management system before pursuing formal certification. Organizations facing regulatory expectations of structured AI governance can use the guidance to assess and close readiness gaps.

Research2026-09-01

SR 26-2 Forces Banks to Rethink Model Governance From Inventory to Board Oversight

The OCC and Federal Reserve's revised model risk management guidance, SR 26-2, resets supervisory expectations for U.S. banks by shifting to a materiality-based approach that covers both traditional statistical models and AI systems, replacing the SR 11-7 framework that had governed bank model governance since 2011. Practitioner analysis from CRA identifies four areas banks must redesign: inventory scope, model tiering, validation independence, and governance alignment up to the board. A companion implementation guide from Lumenova AI adds concrete steps, including inventory rationalization and a distinct governance lane for agentic and generative AI, while a proposed academic framework maps a six-layer control architecture for bringing GenAI systems into SR 26-2 scope. Banks that still run AI governance and model risk management as separate programs face the most immediate pressure to harmonize them.