Nobody deployed most of your AI#
Ask where AI touches your business and the first answer is usually a short, tidy list: the licensed copilot, a chatbot on the website, maybe a model in one flagship project. Then someone actually looks. A model is summarizing contracts inside the legal team's document tool. An enrichment step in the CRM is calling an external API on every new lead. A finance macro routes invoices through a service no one put through review. A support queue auto-drafts replies from customer history.
None of that was a decision. It accumulated — one convenient feature at a time — and it's running right now. Gartner's read of the field is blunt about the consequence: roughly 80% of unauthorized AI events are ordinary internal policy violations, not attacks. The risk isn't a hacker. It's your own systems, doing their jobs, in ways no one can currently see end to end.
The question that exposes the gap#
Here's the test that turns vague unease into something concrete. Pick any one of those workflows and ask: what data reached the model, and can you prove none of it left your walls? For most enterprises today the honest answer is a shrug — not because the team is careless, but because there is no record. The action ran; nothing wrote down what it did.
That gap is why "just add a policy" or "buy another AI tool" doesn't land. You can't put rules around what you can't see, and you can't prove what you never recorded.
Recognize first, govern second#
The useful first move isn't a control — it's a look. See where AI actually sits in the work, what it touches, and what would happen if it were wrong, before you change anything. That's the entire premise of starting in Watch mode: observe a real workflow at zero risk and produce the record you don't have yet. Recognition comes first; governance is what you do once you can finally see.
The pieces that follow take single workflows — a claims process, a clinical record, a procurement reconciliation — and walk through exactly what was hiding in each, and what an Inspector caught.
Why the inventory is always wrong the first time#
Ask for a list and you get the things people think of as AI: the assistant, the chatbot, the pilot someone presented at a town hall. Those are the visible ones, and they are usually the best-governed, precisely because they were visible enough to be reviewed.
The ones that matter are shaped differently. They arrived as a feature. A vendor added a summarisation button, a classifier, a smart-routing rule. Nobody bought AI — they renewed a contract and the capability was included in the release notes.
This is why an inventory built by asking is incomplete by construction. You are asking people to recall a decision that was never made.
Three places to look instead#
Inside tools you already pay for. A copilot reads whatever the signed-in user can read, so the exposure is a permissions question wearing an AI costume. Start with the tools that have the widest data access, not the ones with the most AI branding.
In integrations nobody calls AI. Enrichment steps, deduplication, entity matching, spam scoring, routing. These pass real customer data through a model several times a day and have never appeared in an AI governance discussion, because nobody involved uses the word.
In workarounds people built to save time. A script, a macro, a browser extension, a personal account used for a work task. These exist because the sanctioned path was too slow, which means removing them without fixing the path just moves them somewhere less visible.
What to write down for each one#
Four fields, and they fit on one line each. What it reads. What it writes. Who would notice if it were wrong. Whether anything is recorded.
That last field is the one that sorts the list. Anything with no record is not necessarily risky — it is unassessable, which is different and worse, because you cannot rank it against the others.
The order that works#
Find, then measure, then control. Most programmes invert the last two and write policy before they have a single number, which produces rules that block the wrong things and miss the workflows nobody listed.
Watch mode is the measuring step made cheap: read-only, on your own systems, for a bounded period. The output is not a score. It is a description of what is actually happening, which is the thing every later decision depends on and the thing almost nobody has.
Why this is not the same as a tools inventory#
IT already has a list of software. That list will not help much here, because it records what was bought, not what each thing now does. Half the AI in a large organisation arrived inside something already on that list.
The unit you want is not the tool. It is the workflow: a specific piece of work, the data it touches, and the point at which a model is involved. One tool can appear in five workflows with five different risk profiles, and one workflow can involve three tools nobody connected.
One practical note on scope. Do this for one business unit before you do it for the company. A complete inventory of a single unit is useful immediately; a partial inventory of everything is a document nobody trusts and nobody finishes.
Related