Ask a leadership team which AI tools the organization uses, and most will name one or two. Ask the people doing the work, and the list grows. In a 2026 survey of executives and knowledge workers in seven countries, including Canada, about nine in ten executives said they were confident they could see the AI tools in use. About half of workers said they used AI tools their employer had not approved.
Why the list is longer than you think
AI rarely arrives as a single project with its own budget line. Vendors switch on AI features inside software you already license. Staff sign up for free tools to save time. Suppliers apply AI to your data on their side. None of these need a purchase order, so none of them reach the people who approve technology.
Data leaves quietly
Customer, employee and financial information can be entered into tools nobody has reviewed.
Decisions lose an owner
Systems shape decisions about customers, staff and payments with no one accountable for how they behave.
Spend goes untracked
Overlapping subscriptions add up, and nobody can say which uses return value.
Six ways AI enters an organization
Inside software you already use
AI features added to your CRM, finance, HR, productivity and service platforms, often through routine updates.
Standalone AI tools
Dedicated tools for writing, meeting notes, images, translation and research, bought by a team or an individual.
Staff use outside approved tools
Personal accounts, free plans and browser extensions used for work without approval.
Connected assistants and agents
AI tools granted access to email, files or business systems through integrations and sign-in permissions.
Built in-house
Models, scripts and product features in your own code that call an AI service.
On the supplier side
Suppliers and service providers applying AI to your data or to work they do for you.
Where to look
A first inventory can draw on records most organizations already hold. None of these require new software.
Application and sign-in lists
The apps connected to your single sign-on or identity system, and the apps IT manages.
Spending records
Accounts payable vendors, plus card and expense lines for software subscriptions.
Technical records
Approved browser extensions, installed desktop apps, and code or configuration that calls outside services.
Network records
Web traffic or DNS logs showing visits to AI services. Your IT provider can usually supply a summary.
Records miss what staff do on personal accounts and what suppliers do on their side. Short interviews with each function lead close that gap. Start with five questions:
- 1Daily softwareWhich software does this team use every day, and which of those vendors added AI features in the last two years?
- 2Faster workWhich tasks became noticeably faster recently, and what changed?
- 3Personal toolsDoes anyone use AI tools through personal accounts, free plans or browser extensions?
- 4SuppliersWhich suppliers handle our data, and do their contracts mention AI or automated processing?
- 5DecisionsWhere does a system make or recommend a decision about a customer, an employee or a payment?
What to record for each use
A list of tool names is not enough to act on. For each place AI touches the business, record:
- what it does, the system or vendor behind it, and the function that uses it
- the information it handles, from public to personal or regulated
- how much it decides, from informing a person to acting on its own
- who it affects, from one person to customers or the public
- whether a person reviews what it produces
- who owns it, and whether it is approved
- the business value it delivers, and whether that value is measured
With these facts in one register, leadership can see which uses to expand, which need controls first and which to stop.
A five-minute leadership self-check
If your leadership team cannot agree with each statement below, the inventory is worth doing now.
- We have a current list of every AI tool and feature in use, including those inside existing software.
- Every AI use has a named owner.
- We know which AI uses handle personal or confidential information.
- We know where AI makes or recommends decisions about customers, employees or payments.
- We know which AI uses deliver measurable value.
Keep the register current
Vendors add AI features through routine updates, so an inventory taken once goes out of date. Name a keeper for the register, review it at least each quarter, and update it whenever new software or a new supplier is approved. A current register turns a hidden risk into a managed portfolio, and gives every later AI decision a starting point.