AI Governance

The Year-End AI Inventory: What Your Team Actually Adopted

The AI tools your business officially approved are not the ones your team actually uses. A year-end inventory finds the real list before January's planning.

A desktop flat lay with a keyboard, coffee, notebooks and cotton on a grey surface.

Somewhere there is a list of the AI tools your business has approved. It is short, it is tidy, and it is wrong. The real list, the tools your team actually reaches for when the work piles up, is longer and nobody has written it down.

December is the right time to find it, while the year is still fresh and before January's planning builds on assumptions. This is not an audit and nobody is in trouble. It is an inventory, and the tone you set determines whether you get the truth.

Key takeaways

  • The approved-tools list and the actually-used list are always different. Find the second one.

  • Ask in a way that makes honesty safe, or you will inventory the tools people admit to.

  • For each tool, record who uses it, for what, and what data goes into it.

  • Decide per tool: bless it, bound it, or retire it. Most will earn a bounded yes.

  • Feed the result into January's policy conversation instead of guessing.

Step 1: Ask without accusing

The framing matters more than the question. "We are planning next year and want to know which tools genuinely help" gets answers. "We need a list of unauthorized AI use" gets silence and a false sense of security.

Ask everyone, including yourself. Owners and managers are usually the heaviest unapproved users, and admitting that first makes everyone else's honesty cheaper.

Step 2: Record three things per tool

Keep the inventory simple: who uses it, what for, and what information goes into it. The third question is the one that matters. Drafting marketing copy with public details is a different risk from summarizing customer records or pasting in financials.

Do not forget the quiet entry points: AI features inside tools you already pay for, browser extensions, and the summarizer built into the meeting software. Features arrive by update, not by purchase order.

Step 3: Sort into bless, bound or retire

Most tools will earn a bounded yes: fine for drafting and brainstorming, not for customer data, contracts or anything you would not email to a stranger. A few will earn a full blessing. A few, usually the ones nobody can explain, get retired.

Write the decision next to each tool, one line each. The point is not a rulebook; it is that January's version of this conversation starts from facts.

Step 4: Turn the list into next year's baseline

The inventory becomes the first agenda item for January's AI conversation: here is what we actually use, here is what we have decided about each one, here is the gap between the two.

If any of the output ends up in front of your board, the same honesty applies there. We wrote about labeling what the machine drafted in board papers; the inventory is the internal version of the same habit.

Frequently asked questions

What if people do not answer honestly?

Then the framing failed, not the people. Lead with your own list, make it clear this is planning rather than enforcement, and thank the honest answers publicly.

How long should this take?

A week of collection and an hour of sorting. Anything heavier turns a simple inventory into a program nobody finishes.

Do we need to inventory free personal accounts?

Yes, those matter most. Work done in a personal AI account is outside every control you have, and it is usually where the sensitive data goes.

A practical next step

Send the inventory question around this week while the year is fresh, and give people a few quiet days to answer honestly. If the answers surprise you and you want help turning them into a workable policy, book a Decision-Clarity Call.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on AI Governance

All CISO Insights
AI Governance

Who Signs Off on a New AI Use Case?

AI use-case approval needs a business owner, qualified reviewers and an authority boundary. Build an intake route that distinguishes tool purchase from permission to deploy.