Organizations should inventory categories of people whose data they process.

AIR-1C31FD0739 · version 2 · Data & IP · candidate interpretation

Organization should inventory affected person categories.

Situation & purpose

An AI system or employee activity involves affected person categories. Confirm the actor and source conditions before using this template.

Provide a traceable control for the action: inventory affected person categories.

Examples

Meets the rule: Organization follows the recommendation to "inventory" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..
Does not meet the rule: Organization omits the recommended action "inventory" for affected person categories. This is a recommendation gap, not by itself a statutory violation.
Outside scope: The actor, activity, jurisdiction, or applicability conditions in this source variant do not match.

Evidence & enforcement

Dated record of the action
Responsible actor and approval, where required
Applicable source edition and scope

Human or authorized system adapter required. Machine-executable: no. Convert to a reviewed organization contract and validate the adapter before deployment.

Limits

A rule card is an interpretation aid, not an applicability determination.

Equivalent intent does not make different source obligations interchangeable.

Owner review

Record your interpretation decision. This does not adopt a policy for an organization.

Review reason

Owner sign-in

JSON rule card

{
  "id": "AIR-1C31FD0739",
  "version": 2,
  "title": "Organizations should inventory categories of people whose data they process.",
  "text": "Organization should inventory affected person categories.",
  "topic": "Data & IP",
  "intent": "inventory affected person categories",
  "status": "candidate",
  "semanticStatus": "human-validation-required",
  "variants": [
    {
      "sourceId": "nist-privacy-1",
      "control": "ID.IM-P3",
      "sourceVersion": "CSWP 10 / 1.0",
      "url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24",
      "actor": "Organization",
      "modality": "should",
      "action": "inventory",
      "object": "affected person categories",
      "condition": "Within the source scope; assess applicability before adoption.",
      "exception": null,
      "timing": null,
      "authority": "voluntary",
      "jurisdiction": "United States",
      "checkedAt": "2026-09-28",
      "status": "interpretation-needs-review",
      "examples": {
        "meetsRule": "Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..",
        "doesNotMeetRule": "Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      }
    }
  ],
  "situation": "An AI system or employee activity involves affected person categories. Confirm the actor and source conditions before using this template.",
  "purpose": "Provide a traceable control for the action: inventory affected person categories.",
  "examples": {
    "meetsRule": "Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..",
    "doesNotMeetRule": "Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.",
    "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
  },
  "evidence": [
    "Dated record of the action",
    "Responsible actor and approval, where required",
    "Applicable source edition and scope"
  ],
  "enforcement": {
    "mode": "policy-template",
    "adapter": "Human or authorized system adapter required",
    "machineExecutable": false
  },
  "limitations": [
    "A rule card is an interpretation aid, not an applicability determination.",
    "Equivalent intent does not make different source obligations interchangeable."
  ],
  "createdAt": "2026-10-03",
  "updatedAt": "2026-10-03"
}

Back to registry