Shadow AI often begins with an employee trying to solve a problem: a trial account, a browser extension, or an assistant inside the CRM. Discovery works better when people can explain that need without expecting blame.
Ask about the whole workflow
Which tools are free and which are paid? Do they receive customer or employee information? Are accounts connected to the organization’s identity system? Can the tool only suggest an answer, or can it change a business record?
Turn the inventory into a management process
Record the purpose, data, supplier, and permissions. Assess the risk, choose proportionate controls, and assign an owner. ISO 42001 can provide a broader framework for documenting and reviewing these decisions as AI use develops across the organization.