Your AI Inventory Is Step Zero

Before risk registers, before vendor diligence, before incident plans, there's step zero: know what AI your organization is actually using.

You probably know about fewer tools than you think. Marketing signed up for a writing assistant. Sales is using a call transcriber. Someone in operations found a free PDF summarizer and pasted a client contract into it last Tuesday. This is shadow AI — tools adopted without review, each carrying data you never agreed to share.

The fix starts embarrassingly simple: a spreadsheet. Columns for tool name, what it does, who uses it, what data it touches, and whether anyone vetted it. Send it to every team lead and ask them to fill in their rows. You'll be surprised, and that's the point.

This inventory is the foundation everything else stands on. Your risk register lists risks per tool — but only for tools you know about. Your vendor diligence covers vendors you've identified. Your incident plan assumes you know what's connected to what.

You can't govern what you can't see. Step zero is a list. Start there.

I explain frameworks; I don't give legal counsel.