Question 16 of 24
Do we have a complete AI inventory?
Building and maintaining a centralized registry of every AI tool in use, including shadow AI discovered through procurement, network, and employee channels.
Shadow AI is the largest gap in most inventories
Shadow AI refers to AI tools used by employees without organizational approval or awareness. The prevalence of consumer AI tools with free tiers, browser extensions, and mobile applications has made shadow AI a significant and growing risk. Employees are using AI to process customer data, draft confidential communications, and analyze proprietary information in tools that have not been vetted by IT, Legal, or Risk.
You cannot govern what you do not know about. The starting point for any AI governance program is a complete inventory, which requires actively looking for shadow AI rather than assuming that only approved tools are in use.
Discovery methods
Network monitoring: Work with IT to identify traffic to known AI API endpoints. Many AI tools communicate with a small number of providers (OpenAI, Anthropic, Google, Cohere) whose API domains can be monitored. This surfaces tools that employees are accessing from work devices and networks.
Procurement review: Audit vendor contracts and software subscriptions for AI capabilities. Many enterprise software products have added AI features that may not have been present when the contract was signed. Salesforce, Microsoft, Google Workspace, and most major platforms now include AI capabilities by default.
Employee survey: Ask employees directly what AI tools they use in their work. A well-designed survey with amnesty for past use and a clear path to get tools approved is more effective than trying to catch people after the fact. People generally want to use effective tools. Give them a legitimate channel to request approval.
Maintaining the inventory
An inventory compiled once and not maintained is worse than no inventory, because it creates false confidence. Build inventory maintenance into ongoing processes: require IT procurement to flag AI capabilities in new purchases, include AI tool disclosure in employee onboarding and annual acknowledgments, and review the inventory quarterly against network monitoring data.
Assign an owner to each inventoried system and a risk classification. The owner is responsible for monitoring the system for changes, ensuring ongoing compliance with applicable policies, and notifying the governance function if the system's use case or risk profile changes.