Most companies now have more AI tools in use than anyone has approved, and an AI policy that is rarely checked against reality. A short quarterly review fixes both without slowing teams down: find what is in use, understand the data involved, compare it with policy and make explicit decisions. These four steps keep it light enough to repeat every quarter.

Step 1 — Find what is in use

Goal: Build an honest inventory of AI tools.

  1. Pull AI-related licences, subscriptions and expense claims.
  2. Check browser extensions and integrations connected to company accounts.
  3. Run a short, open survey asking teams which AI tools they use and for what.
  4. Merge the results into one list with an owner for each tool.

You finish with: An inventory of AI tools with owners and use.

Step 2 — Assess each tool

Goal: Understand the data and terms behind each tool.

  1. Record what data each tool touches: customer, employee, financial or none.
  2. Check contract and privacy terms, especially data use for training and retention.
  3. Note any incidents, complaints or near misses.
  4. Rate each tool by value to the team and risk to the company.

You finish with: A one-line assessment per tool covering data, terms, value and risk.

Step 3 — Compare with policy

Goal: See where practice and policy differ.

  1. Check each tool against the AI use policy.
  2. List gaps: unapproved tools, sensitive data in the wrong tool, missing training.
  3. Note where the policy itself is unclear or out of date.
  4. Prepare options for each gap: approve with conditions, restrict, replace or retire.

You finish with: A short list of gaps with options for each.

Step 4 — Decide and update

Goal: Turn the review into decisions and a better policy.

  1. Present the inventory, gaps and options to leadership.
  2. Record a decision for each tool: approve, restrict or retire.
  3. Update the policy and tell teams what changed and why.
  4. Set the date for next quarter’s review.

You finish with: Recorded decisions, an updated policy and a date for the next review.

Common pitfalls

  • Monitoring staff covertly instead of asking openly.
  • Treating the review as a ban list rather than a decision process.
  • Ignoring data and contract terms behind popular tools.
  • Updating the policy without telling teams what changed.

See it as a workflow

Leadership

Quarterly AI usage and risk review

Each quarter, take stock of which AI tools people actually use, what data goes into them and how that matches policy, so leadership can approve, restrict or retire tools with evidence instead of guesswork.

See the workflow

More guides like this

Related answers

Read as Markdown Fractional Chief AI Officer