Forty-Seven AI Tools Discovered Through Expense Reports
You are three weeks into a newly created lead AI risk manager role at a 5,000-person professional-services firm. A finance review of expense reports surfaced 47 distinct AI tools in active use, from note-taking assistants to a document-drafting tool embedded in client deliverables. You estimate 12 process client confidential data and at least 3 have no data processing agreement. Procurement explains that most were bought by individual business units under a $10,000 SaaS threshold that requires only manager sign-off, and that this was 'approved under policy.' Two practice leads have told you privately that they will not disclose their full tool list because they expect a ban. The regulator in your jurisdiction requires firms to maintain a register of high-risk AI systems and to be able to produce it on request. The board wants a risk-tiered inventory in 60 days. No AI policy exists, and there is no AI risk appetite statement, no approval workflow, and no way to detect a new tool entering use.
1. Design the inventory and tiering approach you can actually deliver in 60 days. What do you build, what do you skip, and why?
Read the worked answer
Build the register first, the taxonomy second. A 60-day deadline with no existing data means the deliverable is a defensible minimum register, not a complete one. Say so in the cover note - an inventory that claims completeness and is later shown to miss systems is worse than one that states its detection basis and known gaps.
Detection triangulation rather than a voluntary survey, because a survey of people who fear a ban produces under-reporting. Three sources: expense and procurement records (already have 47), SSO/identity-provider logs of OAuth grants and SaaS sign-ins (catches free tiers and shadow integrations), and network egress logs to known AI endpoints. Reconcile the three lists; the union is the working population.
Tiering on two axes, not one. Consequence (does it touch client confidential data, make or materially inform a decision about a person, feed a client deliverable, or operate without human review) and exposure (data residency, retention, training-on-input terms, DPA in place, access breadth). A note-taking assistant with client audio and no DPA and no retention control is higher risk than a marketing copy generator with a DPA. Produce four tiers with tier-1 requiring immediate action.
Skip building a full model-level assessment for all 47. You cannot validate 47 tools in 60 days and attempting it guarantees a shallow pass across everything. Do a full assessment on roughly the top 8–10 tier-1 tools and a lightweight structured questionnaire for the rest, with a scheduled deepening.
Now, not later, stand up the intake gate. Without an approval workflow, the 47 becomes 60 while you inventory. Publish a one-page interim policy: new AI tools go through a single intake form, no exceptions, and existing tools are grandfathered only if registered within 60 days.
2. How do you handle the politics - retroactive approval of tools bought outside the intended control, and practice leads withholding information?
Read the worked answer
Split the amnesty from the accountability. Announce, with executive sponsorship, that registration within the 60-day window carries no retrospective sanction, and that the firm's exposure discovery window is now. Then state the other half plainly: continued non-disclosure after the window is a disciplinary matter, because it converts a procurement problem into a concealment problem. Amnesty without a hard edge is an invitation to keep hiding; a hard edge without amnesty guarantees the inventory is wrong.
Do not blame the business units. Procurement's $10,000 threshold plus 'approved under policy' means these purchases were compliant with the control environment the firm designed. The finding is a control design failure - a financial materiality threshold being used as a proxy for data and model risk - not employee misconduct. Saying this out loud is what makes the amnesty credible and moves the conversation from blame to design.
Address the fear of a ban directly. Practice leads withhold because they expect prohibition. Publish the decision logic: most tools will be permitted with conditions (DPA, no training on client data, retention limits), some will be prohibited where the vendor cannot meet baseline data terms, and the register is what distinguishes the two. A register that mostly results in 'yes, with conditions' is the only one people will feed.
Give the practice leads a route. Offer a 30-minute confidential pre-registration conversation where they can surface tools without an immediate escalation, and be explicit that you will escalate only genuine tier-1 findings. That is a real concession, and it is cheaper than an incomplete register.
Escalate once, precisely. If a lead still withholds after the window, take one documented case to the risk committee rather than a general complaint. A specific case with a named gap changes behaviour; a vague allegation of cultural resistance does not.
3. What exactly do you tell the board at day 60, including what you still cannot assure them of?
Read the worked answer
Structure the report as three claims and one set of gaps. Boards remember framing, not tables.
Claim 1 - what we now know. A named register of N systems (expect somewhat more than 47 once SSO and egress logs are reconciled), each tiered, each with an owner, a data classification, and a DPA status. Report the number with client data and no DPA explicitly; that is the single most actionable figure.
Claim 2 - what we did about the worst. Enumerate the tier-1 actions: tools stopped, contracts remediated, tools restricted from client data. Give counts, not adjectives. If a tool was prohibited, say which and what the compensating workflow is, because 'we banned it' invites the question of what people use instead.
Claim 3 - what is now different. The intake gate, the approval workflow, and the ongoing detection method. The durable message is that the board will not receive a point-in-time clean bill; they will receive a standing feed. Ask for a specific decision: formal adoption of the AI risk appetite statement, which you should bring as a one-page proposal with tolerances rather than a request to draft one.
The gaps - state them without softening. (a) The register is a floor, not a census: tools used on personal accounts or on-device without network egress remain undetectable, and I cannot quantify that population. (b) Roughly two-thirds of systems have had a questionnaire-level review, not an assessment. (c) No tool has been independently validated for output quality. (d) The regulator's register requirement may exceed what we can produce today; confirm scope with them rather than guessing.
Close with the honest sentence: the material finding is not that 47 tools were in use - it is that the firm had no mechanism that would have known. That mechanism now exists in draft and needs a year to mature.