How to build an AI inventory

Where to look

Sanctioned tools are the easy part. The inventory that matters includes what nobody told you about:

• Card and expense records. Search for AI vendor names across twelve months. Departmental subscriptions live here.
• SSO and identity logs. Which third-party applications staff have authenticated into.
• Browser extensions, if you have any visibility. A writing assistant extension can read every page it is on.
• Features inside tools you already pay for. Your CRM, help desk and office suite have all added AI features, frequently enabled by default.
• Ask people directly, without consequence attached. Make it explicit that the point is to sanction what is useful, not to discipline anyone. You will get a far better answer.

What to record

• Tool name and vendor.
• Who uses it, and how often — against licences purchased.
• What data goes into it, using your classification.
• Whether the vendor trains on that data, and under which agreement.
• Cost, and who pays.
• An internal owner. A tool with no owner is the one that causes the incident.

What you will find

Three things, reliably. Unused licences, usually enough to cover the cost of doing this. Duplicate tools doing the same job in different departments. And shadow usage.

Treat the shadow usage as product feedback rather than misconduct. Staff went around the sanctioned tools because those tools did not do the job. Sanctioning a good tool they found is a better outcome than banning it and watching usage move somewhere you cannot see.