Your AI Audit Trail Starts With a List

In my federal grants compliance days, I could tell you where every dollar went, because the system required a trail before the money moved. Nobody called it burdensome. They called it Tuesday.

AI needs the same boring discipline. Start with an inventory — a simple list of every AI tool your organization uses, what each one does, whose data it touches, and who owns it. Include the ones nobody approved. Especially those. The marketing intern's chatbot subscription counts. The free transcription tool counts.

This list is the foundation of everything else: your risk assessments, your testing, your vendor questions, your incident response. An audit trail is an audit trail, whether it's grant dollars or model outputs. Start with the list.

I explain frameworks; I don't give legal counsel.