Banning AI tools does not work. It moves usage onto personal accounts where you have no visibility at all. This policy assumes people will use AI and makes the boundary explicit: which tools, which data, and how to get something new approved.
You cannot govern AI usage you cannot see, and most AI adoption happens through free tiers and browser extensions that never touch procurement. This inventory is built to surface those, which a record of what you bought will not show.
Shadow AI differs from ordinary shadow IT in what leaves the building: unstructured text that may contain anything, pasted by someone who did not consider it a data transfer. This worksheet is a repeatable discovery sweep.
AI risk assessments often reduce to a data protection review, which misses the failure modes specific to these systems: confidently wrong output, drift, prompt injection, and decisions affecting individuals. This template covers those explicitly.
An AI approval process that takes six weeks guarantees people stop asking. This form is deliberately short: enough to make a sound decision, fast enough that requesting approval stays easier than going around it.
AI problems rarely arrive as incidents. They surface as a wrong figure in a report or a customer noticing something odd, and are fixed quietly without anyone recording a pattern. This log makes the pattern visible.