Every AI governance framework starts in the same place: figuring out what your company is actually using.
This sounds simple. It's not. At most companies, AI adoption has been bottom-up and ungoverned. Individual employees signed up for tools. Engineers plugged in API keys. Teams built internal tools on top of models. Nobody tracked any of it.
Before you write a policy, before you evaluate risk, before you talk to your auditor, you need to know what's in your environment.
How to run the inventory
Send a company-wide survey. Keep it short. Three questions: What AI tools do you use for work? What do you use them for? What data do you put into them?
You'll be surprised. Marketing is using ChatGPT to draft customer emails. Engineering is using Claude Code to write and debug production code. Customer success is pasting support tickets into AI tools to draft responses. Sales is using AI to research prospects. Product is running analytics queries through AI. Some of these tools have enterprise agreements. Most don't.
Check your systems
Surveys catch what people remember. Systems catch everything else.
Review your SSO/SAML logs for AI-related applications. Check expense reports and credit card statements for AI subscriptions. Look at browser extensions across your fleet. Review API keys in your codebase and CI/CD pipeline. Check your cloud provider marketplace for AI services that have been enabled.
Build the register
For every AI tool you find, document:
- Tool name and provider.
- Who's using it and which team.
- What plan or tier (free, pro, enterprise, API).
- What data goes into it — customer data, PHI, PII, source code, internal docs, or public info only.
- Whether there's a signed agreement (BAA, DPA, enterprise contract).
- Whether data is used for model training.
- Retention policy.
- Whether the tool has agentic capabilities — can it take actions, access files, execute code.
This register is the foundation of everything that follows. It's also the first thing an auditor or enterprise customer will ask for when they want to understand your AI governance posture.
What you'll probably find
More tools than anyone expected. Most companies discover 3 to 5x more AI tools in use than leadership knew about.
Data flowing somewhere it shouldn't. PHI or PII going into consumer-grade tools without BAAs. Engineers using agentic tools with admin access to production.
No consistency in plans or tiers. Half the team on free accounts, some on personal pro plans, a few with enterprise agreements — often for the same tool.
That's normal. The point of the inventory isn't to punish anyone. It's to get a clear picture so you can make informed decisions about what to approve, what to restrict, and what to shut down.
Why this matters now
Enterprise buyers, compliance frameworks like ISO 42001, and regulators are all starting to ask pointed questions about AI use. The companies that can produce a clean, accurate AI inventory when asked — from a customer security review, an audit, or a board meeting — are the ones that build trust faster.
The inventory is the first step. Everything else — policy, risk classification, vendor review — builds on top of it.
Up next in the series
In Part 2, we write an AI acceptable use policy your team will actually follow.
Read Part 2 →
This article is part of Com-Sec's AI Governance series for startups and growth-stage companies. Learn more at com-sec.io.