Your approved AI tools list is a statement of what you have decided. It is not a description of what people use. Somewhere in the gap are a transcription service a sales team signed up for, a browser extension that rewrites emails, and an AI feature that switched on in a tool you bought years ago.
None of this is usually malicious. People found something that helped and did not think of it as a procurement decision. The risk is real anyway: customer data reaching a service with no contract, no review, and terms that may allow training on what it receives.
This article covers where to look, what each source can and cannot tell you, and how to triage what you find. The goal is to bring tools under governance, not to catch people. Your AI system inventory is where the results end up.
Where to look
No single source finds everything. Use several, and expect each to show a different slice.
Identity provider and OAuth grants
Many AI tools ask users to sign in with their work account, or to grant access to email, calendars, or documents. Those grants are recorded.
Review third-party application grants in your identity provider and in your productivity suite's admin console. Look for apps with scopes like reading mail, reading files, or accessing calendars.
Check which apps users have signed into through single sign-on that are not in your app catalog.
This is often the most productive source, because it shows not only that a tool is used but what data it can reach. A meeting assistant with read access to every calendar and recording is a different finding from one with no grants.
Expense and procurement records
Small subscriptions on company cards and expense claims are a reliable trail. Search card statements and reimbursements for AI vendors and for categories like transcription, writing, and coding assistants. Team-level subscriptions often appear here and nowhere else.
This overlaps with the wider work described in managing SaaS sprawl. If you already run that review, add AI as a category rather than starting a second one.
Browser extensions
Extensions that read page content can see whatever the user sees, including internal systems and customer records. If you manage browsers centrally, pull the list of installed extensions across the fleet and look for AI writing, summarizing, and assistant extensions.
If browsers are not managed, this source is invisible to you. Say so in your findings rather than reporting a clean result.
Network and DNS logs
If traffic passes through a secure web gateway or your DNS resolver, logs show connections to AI service domains. This can reveal use that never touched a company account.
The limits are significant. Remote staff off the corporate network, encrypted DNS, and personal devices all bypass it. Treat network data as confirming evidence, not a complete picture.
AI features in tools you already own
This is the category teams miss most often. Vendors add AI features to existing products, sometimes enabled by default. No new procurement happens, so no review happens.
Go through the admin consoles of your main SaaS tools: productivity suite, CRM, support desk, code hosting, design, and meeting software. For each, check whether AI features exist, whether they are on, and what data they process. Then read the vendor's current terms for those features, which may differ from the terms you reviewed at purchase.
Code and cloud accounts
Engineers can call model providers directly. Look for provider API keys in secrets scanning results, model provider charges on cloud bills or company cards, and provider SDKs in internal tools. A personal API key used in a company service is both a shadow AI finding and a credential finding.
Ask
A short, non-punitive survey finds things no log will: tools on personal devices, personal accounts, and use people did not think counted. Ask three questions. Which AI tools do you use for work? What do you use them for? What kind of data goes in?
Frame it as an amnesty. If people expect discipline, they will not answer, and you lose your best source.
A note on monitoring staff
Some of these sources involve looking at what employees do. Rules on workplace monitoring vary by country, and some jurisdictions require consultation with employee representatives or a clear legal basis. Under GDPR, monitoring logs that identify individuals are personal data. Confirm the position with counsel before expanding monitoring, and prefer aggregate views, such as which tools are in use, over individual tracking where that answers the question.
Triage what you find
You will find more than you can review at once. Prioritize by the data involved, not by how many people use a tool.
Restricted or customer data in an unapproved tool. Act first. Find out what data went in, read the vendor's terms on retention and training, and decide whether the exposure needs to be handled as an incident.
Confidential data, or broad access grants. Review next. A tool with read access to every mailbox is high priority even if few people use it.
Internal data, narrow use. Review on your normal vendor cycle.
Public data only. Record it and apply your quick approval path.
For each tool, reach one of four decisions:
Approve. It goes through your vendor review, using the questions in AI vendor risk, and onto the approved list.
Approve with conditions. For example, company accounts only, or public and internal data only.
Replace. An approved tool already does the job. Move users to it and help them do so.
Block. The tool cannot meet your requirements. Revoke grants, block the domain where you can, and tell users why and what to use instead.
Bring each tool under governance
A discovered tool is governed once it has the same records as any approved one:
An inventory entry with a named owner
A completed vendor review proportional to its data
A place on the approved list, with any conditions
Coverage in your AI acceptable use policy, if it reveals a category the policy did not anticipate
Close the loop with the people who reported tools in the survey. Telling them what was approved is the best encouragement for the next round.
Keep a record of the sweep itself: the date, the sources you checked, the sources you could not check and why, what you found, and the decision for each tool. If a customer or auditor later asks how you know your inventory is complete, this is the answer. It will not prove completeness, and it should not claim to. It shows you looked deliberately, in named places, and acted on the results.
Make discovery repeat
One sweep goes stale. Turn the productive sources into standing checks:
Alert on new third-party application grants with sensitive scopes.
Review AI-related expenses monthly or quarterly.
Check major SaaS admin consoles for new AI features at each vendor review.
Rerun the survey once or twice a year.
If you are working toward ISO/IEC 42001, record the discovery process and its results. It shows your AI management system scope is based on what you looked for, not only on what you were told.
How TrustLynce helps
TrustLynce's third-party risk tools record each discovered AI tool in the vendor inventory, assign a risk tier, run the review, and schedule reassessment. Policy acceptance tracking shows who has acknowledged each version of your acceptable use policy as it changes.