Implementation Kit
AI Inventory Completeness Checklist and Discovery Survey
For the second pass, when the question is whether the inventory is actually complete. A master template, an amnesty disclosure survey, a reconciliation log that proves every discovery method was run, and a standing quarterly review agenda.
Who this is for: The governance lead who has an inventory already and needs to show it is complete and stays that way.
1. AI inventory master template
SpreadsheetThe consolidated list. One row per system, reconciled from every discovery source.
Template
| System | Owner | Vendor | Use case | Data processed | Risk tier | Discovery source | Date added | Last reviewed |
|---|---|---|---|---|---|---|---|---|
| <system> | <name, role> | <vendor or in-house> | <what it does> | <data categories> | Minimal / Limited / High | contract audit / survey / network scan / prior list | YYYY-MM-DD | YYYY-MM-DD |
Worked example
| System | Owner | Vendor | Use case | Data processed | Risk tier | Discovery source | Date added | Last reviewed |
|---|---|---|---|---|---|---|---|---|
| Resume Screener | D. Portillo, Talent | Greenhouse + in-house | Applicant ranking | CVs, contact details | High | prior list + contract audit | 2026-02-11 | 2026-08-30 |
| Meeting Notetaker | R. Cho, IT | Otter.ai | Call transcription and summary | Meeting audio, participant names | Limited | employee survey | 2026-09-01 | 2026-09-01 |
| Ad Copy Generator | L. Suarez, Marketing | ChatGPT (team) | Draft ad variants | Campaign briefs, no customer data | Minimal | network scan | 2026-09-02 | 2026-09-02 |
Acceptance criteria
- ✓Every row records which discovery method surfaced it, so coverage gaps are visible.
- ✓The list has been reconciled against any prior inventory, with additions and removals noted.
- ✓Each row has a named owner and a risk tier.
2. AI disclosure survey
DocumentThe amnesty survey that surfaces tools procurement never saw. Same framing as the shadow-AI survey in the inventory-and-classification kit.
Template
All staff. Short. Amnesty first.
Intro: We are confirming the list of AI tools in use so we can support them. Not an audit. Nothing you disclose is held against you. Disclosed tools get a fast review and a path to approval.
Questions:
- Which AI tools do you use for work, including personal-account or free-tier use?
- What do you use each for?
- What category of information goes into it?
- Did it come through IT or procurement, or did you start using it directly?
- Would switching it off tomorrow disrupt your work?
Worked example
Response, T. Bauer, Sales:
- Gemini in the personal Google account; the CRM's "draft email" button.
- Gemini for prospect research summaries. CRM button for follow-up emails.
- Gemini: public company info. CRM: contact names and deal notes.
- Neither. The CRM feature appeared in an update.
- Gemini yes, CRM button no.
Triage: CRM draft-email feature puts deal notes through a vendor model. Confirm data handling with the CRM vendor, add as Limited. Personal Gemini use: route to the enterprise tenant, add as Minimal.
Acceptance criteria
- ✓The survey reached all staff, and response rate is tracked and chased.
- ✓Every disclosed tool is triaged and either added to the master template or ruled out with a reason.
3. Discovery reconciliation log
SpreadsheetThe evidence that completeness was actually pursued: which sources were run, what each found, and what was new.
Template
| Discovery source | Run date | Run by | Systems found | New (not on prior list) | Notes |
|---|---|---|---|---|---|
| Vendor contract audit | YYYY-MM-DD | <name> | <count> | <count> | |
| Employee disclosure survey | YYYY-MM-DD | <name> | <count> | <count> | response rate |
| Network endpoint monitoring | YYYY-MM-DD | <name> | <count> | <count> | window covered |
| Expense and card review | YYYY-MM-DD | <name> | <count> | <count> | |
| SSO / OAuth grant review | YYYY-MM-DD | <name> | <count> | <count> |
Worked example
| Discovery source | Run date | Run by | Systems found | New | Notes |
|---|---|---|---|---|---|
| Vendor contract audit | 2026-08-18 | Procurement | 22 | 3 | 3 vendors added AI features post-signature |
| Employee disclosure survey | 2026-08-25 | AI Gov Lead | 31 | 11 | 74% response rate; second reminder sent to non-responders |
| Network endpoint monitoring | 2026-08-28 | Security | 14 | 2 | 14-day capture of traffic to known model API domains |
| Expense and card review | 2026-08-29 | Finance | 9 | 1 | one personal-card AI subscription |
| SSO / OAuth grant review | 2026-08-31 | IT | 12 | 4 | 4 third-party apps with model API scopes |
Acceptance criteria
- ✓At least three independent discovery methods were run, not one.
- ✓Each source names a run date and an owner, so the exercise can be repeated on a cycle.
- ✓Every new system found is reflected in the master template.
4. Quarterly inventory review agenda
DocumentKeeps the inventory from going stale. A standing agenda for the review meeting.
Template
45 minutes, quarterly, owned by the AI governance lead.
- New systems added since last quarter (from procurement, onboarding, incident triage)
- Systems retired or replaced; confirm register updated
- Rows with a review date now overdue; assign catch-up owners
- Tier changes: any system whose use case or data changed
- Rows still missing an owner or a tier
- Discovery refresh: is any method due to be re-run?
- Actions, owners, dates
Worked example
Q3 2026 review, 2026-10-05:
- Added: 4 (2 from procurement, 1 from onboarding, 1 from a Sev-2 triage). All tiered and owned.
- Retired: 1 (legacy chatbot). Register updated.
- Overdue reviews: 6, down from 11. Assigned to owners with a 2-week deadline.
- Tier changes: support copilot moved Minimal to Limited after it started drafting refund decisions.
- Missing owner or tier: 0.
- Discovery refresh: network scan due, scheduled for 2026-10-20.
- Actions logged.
Acceptance criteria
- ✓The review is on the calendar for the year with a named owner.
- ✓Every overdue row leaves the meeting with a catch-up owner and a date.
- ✓The discovery methods are re-run on a defined cadence, not only once.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The reconciliation log and quarterly agenda show intake is a continuous process feeding the register, not a one-off.
Every master-template row carries a risk tier from the same classification method.
The disclosure survey and reconciliation log evidence an active hunt for shadow and embedded third-party AI.
The completed master template is the algorithm register.
The "data processed" column records where personal data enters each AI system.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →