PCC Learning Center · AI Governance
Know Which AI Tools Your Business Is Using
A practical workbook for recording AI tools, connected applications, owners, users, data access, OAuth permissions and review priorities.
What This Workbook Is For
This is not a test, and you do not need every answer on the first day. The inventory gives your business one shared list of AI tools, owners, users, business purposes, data access and unresolved questions.
The practical goal: know what is being used, identify the tools that deserve attention first and assign someone to make the next decision.
Why an AI Inventory Matters
Employees can begin using an AI tool in minutes. Without a shared inventory, the business may not know what information employees enter, which systems tools connect to or who is responsible for reviewing them.
Find Hidden Use
Include approved, unapproved, free, paid, embedded and experimental tools—not just software purchased by IT.
Understand Exposure
Record sensitive data, connected systems, OAuth permissions, consent scope, service identities and whether the tool can produce output or take actions.
Assign a Decision
Give every tool an owner, review status, approval decision and next review date.
Complete It in Three Passes
Start with visibility. Add security and approval details as each tool is reviewed.
1. Find the Tools
Record the tool, vendor, business purpose, owner, users and current status. Unknown answers should not prevent you from starting.
2. Understand Data and Access
Record the highest type of data handled, connected systems, delegated or application permissions, tenant-wide consent, identities and action capabilities.
3. Review and Decide
Complete security and privacy reviews, define human-approval requirements and document the business decision.
What the Workbook Includes
Start Here
Plain-English instructions, boundaries and an explanation of the priority rating.
AI Tool Inventory
The working register for tools, owners, uses, data, access, reviews and decisions.
Review Dashboard
A summary of high- and medium-priority items, missing owners, incomplete reviews and pending decisions.
Lists
The controlled dropdown values and documented priority logic used by the workbook.
Questions to Ask Employees
Frame this as discovery—not a disciplinary investigation. Employees are more likely to disclose unapproved use when the immediate goal is to establish clear rules.
- Which AI chatbots, assistants or writing tools do you use for work?
- Do you use AI features inside software the business already pays for?
- Do any tools record or summarize meetings?
- Have you connected AI to company email, calendars, files or applications?
- Did the tool ask you or an administrator to approve access to company data?
- Does the connection act only for one user, or can it access information across the organization?
- Do you enter client, employee, financial or confidential information?
- Can the tool send messages, update records, create files or take other actions?
- Is the account free, individually purchased or company-managed?
- What work would be disrupted if the tool were removed?
Common Questions
Do we include AI features inside existing software?
Yes, when the feature handles business data, connects to systems, changes how information is processed or can take actions.
What if we do not know an answer?
Record what is known and use Unknown, Not Started or Pending where available. An acknowledged gap is useful information.
Does Low priority mean the tool is approved?
No. Priority determines what deserves attention first. Approval is a separate business decision.
How often should we update the inventory?
Review it at least quarterly and whenever a tool, owner, integration, vendor term, business purpose or access level changes.
Should OAuth and third-party applications be included?
Yes. Record applications that connect to Microsoft 365 or another business system, even if the application is not marketed as AI. Capture the owner, permissions, consent scope and last permission review.
Start With Visibility
You do not need a perfect governance program before identifying which tools your business uses. Begin with the departments most likely to use AI for client work, sensitive information or connected business processes.
Still deciding which AI platform fits your business?
Use our ChatGPT vs. Claude Business Decision Guide to compare both platforms using consistent workflows, security requirements and administrative controls.