Start with the tools people actually use: work accounts, personal subscriptions, browser extensions, trial accounts, and assistants embedded in existing software. Ask what task each tool helps with and what information goes into it.
A focused first week
Create a short inventory with a user, purpose, supplier, and data category for each tool. Identify uses involving customer, employee, financial, or other sensitive information. Agree which uses must pause for review and which can continue under clear conditions.
Keep the picture current
Assign an owner and schedule a regular review. Give the team a clear way to request a tool or report an unexpected result. When the organization is ready for a broader AI management system, this inventory becomes a useful starting point for ISO 42001 work.