How to run an AI tool audit in an afternoon

Most leaders are surprised by how much AI is already in the building. Not the AI you bought. The AI your team picked up on their own, on a free plan, with a work email, on data you never signed off on.

You cannot govern what you cannot see. So before you set rules or buy anything, see what is already there. Here is a way to do it in an afternoon.

Start with one question to the team

Send one message: “What AI tools are you using for work right now? No judgment. We just want the full list.” Make it safe to answer honestly. You want the quiet tools, the personal logins, the browser extensions, the ones running inside software you already pay for.

Build one simple list

Put it in a single sheet. For each tool, capture five things:

• The tool, and what it is used for
• Who uses it, and who owns it
• What it costs, and who is paying
• What data goes into it
• Whether it was approved

Do not make it fancy. The point is one view that did not exist this morning.

Sort by risk, not by excitement

Now read the list as an owner. Two columns matter most: what data goes in, and whether it was approved. Anything with customer data, financials, or employee information on an unapproved tool goes to the top. That is where you act first.

Decide three things

You do not need a full policy today. You need three decisions: what stays, what stops, and what needs a closer look. Write them down. Tell the team. That is governance starting to exist.

This is the kind of work the first session is built around. When you are ready to put real structure behind it, the next step is a conversation, not a contract.