AI inventory: which AI uses deserve attention first
Six fields to record for each AI use. Five places to find them. Three stated criteria for what to review first.
The assistant nobody installed
A hypothetical example. Last quarter a vendor update switched on an AI assistant inside your ticketing system. Nobody installed it. It reads every customer ticket. It drafts replies. It can look up order history. Nobody filed a change request.
Is it on any list you own? If it is, it is probably a product name. That tells you nothing about what it can reach.
Day one is not about controls. It is about knowing which AI deserves your attention first.
Five places AI hides
Many organisations check only one or two of these.
- What you built. Internal applications that call a model. Notebooks. Pilots that quietly became production.
- What you bought. Software you already pay for that added AI through an update. Check vendor release notes.
- What people brought. Unapproved chatbots, extensions and personal accounts used on corporate devices and networks. Those are discoverable too.
- What connects. AI apps that people let into their mail or files with a single consent click. Check your identity provider's app grants.
- What is embedded. AI inside your security and email tools. The tools you trust to watch everything else.
These routes overlap. One use can turn up twice. Keep one row per use and note where you found it.
A first pass in about a week
In my experience you can get a first pass in about a week. It covers corporate systems and traffic. It will not see personal devices.
- Read your app grants. List every third-party app people have let into their mail or files in your identity provider. Filter for AI.
- Check outbound traffic. Proxy and firewall logs show which machines talk to AI services, and how often.
- Read vendor release notes. Search a year of notes from your largest vendors for the word AI.
- Follow the spend. Check card spend and procurement for small AI subscriptions.
- Then ask, without blame. Ask teams what AI they use that you did not provide. Make it easy to answer honestly.
Six fields, one row per use
- Owner. A named, accountable person.
- Purpose. The business use.
- Reads. What comes in. Flag content written outside the organisation.
- Reaches. The data and systems it can get to, including read-only access. Anything it can reach can end up in an output.
- Acts. What it can do or send, and whether a person checks first.
- Runs as. The identity it uses, and how long that credential lives.
The unit is the use, not the product. If another team uses the same assistant to send refund notes on its own, that is a second row.
Three criteria for what to review first
- Reads outside content. Does it read content written outside your organisation?
- Reaches sensitive data or critical systems.
- Acts without a person. Can it act without a person checking first?
Two or more: the use goes on the first review list. Any open finding: review it now.
One row, worked through
The ticketing assistant, hypothetical.
- Owner — head of customer support
- Purpose — drafts replies to customer tickets
- Reads — customer tickets written by people outside the organisation
- Reaches — ticket history, order records, customer profiles (read-only)
- Acts — drafts; a person reviews and sends
- Runs as — a service account with a token that never expires
Criteria 1 and 2 are met, so it goes on the first review list. The never-expiring token is a finding in its own right, so it is reviewed now. The refunds use meets all three criteria and goes to the top of the list.
What I would do on Monday
- Pull the app grants and the outbound traffic to AI services.
- Search your largest vendors' release notes for the word AI.
- Put each use you find into one row with six fields.
- Apply the three criteria. Name an owner for every use on the first review list by Friday.
What this page is not
It is not a NIST template. The six fields are a working set. The NIST AI Risk Management Framework asks for an inventory and leaves the attributes to each organisation.
It is not complete discovery. A first pass covers corporate systems and traffic, not personal devices.
Sources
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023 — GOVERN 1.6: mechanisms are in place to inventory AI systems. doi.org/10.6028/NIST.AI.100-1
- NIST AI RMF Playbook — GOVERN 1.6
The ticketing assistant and the refunds use are hypothetical. "A first pass in about a week" is professional judgement.