Start With an Inventory. Everything Else Follows.

Every compliance conversation should start with the same question: what AI are you actually using?

Not just what you bought on purpose. Everything. The hiring tool, the chatbot, the resume screener, the thing marketing signed up for with a credit card, the features your vendors quietly added last quarter. Write them all down: what it is, what data it touches, who owns it, and what decisions it influences.

You can't tier what you can't see. You can't document what you haven't listed. You can't oversee what you don't know exists.

An AI inventory is the least glamorous step in governance and the most important one. Everything else, risk tiers, documentation, human oversight, follows from that single list. Start there.

I explain frameworks; I don't give legal counsel.