You can't govern what you can't see.
A simple register of every AI tool and use in the business. A spreadsheet is fine. Not having one isn't.
What to record
One Row Per Use
- Tool and plan (free or business)
- Named owner
- What it's used for
- What data it touches
- Risk tier: Low, Medium or High
- Where the data is processed
- Next review date
Where to find it
The Hunt
- A no-blame staff survey
- Expense claims and card statements
- Installed browser extensions
- AI features switched on inside your existing software
List it, own it, review it.