Inventory the AI you already run, then govern it
AI governance and use assessment for public institutions: every AI tool in use across departments — including the shadow AI running on staff’s personal accounts — inventoried, its data flows and risks assessed, and the machinery put in place to keep the register alive: usage policy, procurement review points and a filing ledger for new applications. Major public frameworks, such as the U.S. Office of Management and Budget’s requirements for federal agencies, all begin from a complete AI use-case inventory. This service delivers that inventory — and the mechanism that keeps it true.
Who it fits, and what gets in the way
Agency leadership and information departments now required to account for AI use upward — while unable to state, today, how much AI the institution already runs.
Departmental purchases and personal subscriptions are mixed together; nobody holds the whole picture of who uses what on which data
Staff run work documents through personal AI accounts; data has left the institution’s boundary and leadership does not know
A use-case inventory is demanded from above; the spreadsheet assembled in a hurry will not withstand questions, and nobody owns its upkeep
What you get
| Component | What is included | Deliverable |
|---|---|---|
| Use-case inventory | Department interviews cross-checked against procurement records; procured and personal tools registered separately | An AI use-case register with a shadow-AI annex |
| Risk assessment | Graded by data sensitivity and use context; high-risk uses flagged with disposition advice | A risk grading table with recommendations |
| Governance policy | Usage policy, data red lines, procurement review points and the filing process, written as formal documents | A policy pack, for the institution to issue |
| Filing ledger mechanism | New applications filed before launch; ledger fields and ownership assigned to named posts | The ledger and its operating procedure |
| Staff training | Two rounds: one for management, one for frontline staff | Training records and materials |
How it runs
Inventory
About three to four weeks: interviews and records cross-checked into the register and shadow annex
Assessment & grading
Risk assessment and disposition advice drafted and taken through internal review
Rules & ledger
Policy finalized for issuance; the filing ledger live and operating
Training & review cycle
Two training rounds close the engagement; register and policy then reviewed quarterly, conclusions filed
Boundaries
Not included
- We do not certify legal conclusions for the institution: assessment follows public frameworks and the institution’s own positions; legal judgment stays with agency counsel
- No crackdown theater: shadow-AI dispositions lead with guidance and sanctioned alternatives — the register exists to see clearly, not to catch people
- Inventory depth follows cooperation: departments that decline interviews are recorded as uncovered, in the register itself
What we need from you
- Interview scheduling across departments and one overall coordinator
- Read access to procurement and subscription records
- The institution’s current data and security policies
How engagement and quoting work
Contracted as an assessment engagement, scoped by department count and entity level in the proposal, through the contract payment channel. Phase one is the inventory alone: with the register in hand, the institution decides how deep the governance build goes. A quarterly review engagement is available afterwards to keep the register from expiring. Confidentiality and data-processing annexes are signed with the contract.
Questions on this page
Will surfacing shadow AI cause trouble?
The purpose is sight, then guidance: the annex is managed separately, sanctioned alternatives come before any restriction. Risk left off paper is the real exposure.
Who keeps the register updated?
The filing mechanism assigns it to named posts inside the institution. A quarterly review engagement is also available, where we reconcile additions each quarter.
How does this differ from the business compliance service?
The business version runs tools, policy and evidence. The government version adds use-case reporting conventions, public-procurement review and the disclosure dimension, framed for public bodies.
Can the findings be published?
That is the institution’s decision. Reports are written to a publishable standard, with sensitive detail in a separate annex the institution can withhold.
Will assessment slow departments down?
No. It starts with a positive list of approved tools and scenarios: inside the list, teams proceed directly; outside it, they register. Governance exists to clear compliant use faster, not to gate everything.
Does the shadow-AI inventory monitor individuals?
No. It looks at tools and data flows only: which tools are in use and where data goes. It reads no personal content and builds no behaviour profiles; reporting aggregates by department.
How do we start?
Use the contact page with your entity level and approximate department count. We return an inventory plan and schedule; phase two is decided after the register lands.
Related
Defense & Managed Response
Beyond governance: the institution’s security defense program
Inventory the AI you already run, then govern it
Tell us where it hurts first. Scoping and a written quote come before anything starts; looking costs nothing.
Or ask Leo, the assistant at the bottom right, first — get the questions clear before you write to us.
