Building an AI tool inventory

You cannot secure what you cannot see, so the first deliverable is an inventory of the AI tools in use. Aim for a living list, not a one-time audit.

Start with the data you already hold. Expense reports and SaaS spend reveal paid subscriptions. Single sign-on logs and identity provider records show which apps people authenticate to. Network and secure web gateway logs, plus any cloud access security broker, surface traffic to known AI domains. Browser-based usage is easy to miss, so include endpoint and browser signals where you have them.

Then ask people directly. A short, blame-free survey often finds more than logs, because it captures the free tools tied to personal accounts. Frame it as help us support the tools you rely on, not gotcha.

Record a consistent set of fields for each tool: name, owner or requesting team, purpose, plan tier, whether it processes sensitive data, data and training terms, authentication method, and approximate cost. This is sometimes called an AI bill of materials.

Finish by assigning a simple status to each entry: approved, limited use with conditions, under review, or not permitted. That status column is what turns a spreadsheet into a control. Revisit the inventory on a set cadence, because new tools appear constantly.

Keep the format lightweight. A shared spreadsheet that is actually maintained beats a sophisticated system that no one updates. This is operational guidance, not legal advice.