AI inventory in a company: the three doors

Ask three questions at your executive committee. Which AI features are active in our company, in which software, and since when? How much does AI cost us per year, across all vendors? Who is allowed to use what, and with which data?

In a company of three hundred people, the honest answer usually fits in one sentence: someone would have to go around the departments. Nobody has the full picture, and it is not negligence. AI did not arrive through a project. It came in through three doors.

Why an AI inventory cannot be done from memory #

Payroll software arrives with a budget, a committee and a go-live date. It leaves a trace. AI, on the other hand, arrived in pieces, with different people, without a shared register.

The spreadsheet sent to department heads settles nothing. Each one declares only what they know. So it contains neither the features enabled by a vendor nor the applications connected by a colleague. And it is wrong on the day it is finished, because the vendors have published new announcements in the meantime.

To draw up the inventory, you have to look door by door.

First door: the vendor #

Your software vendors add AI features to the suites you already pay for. They arrive through an update, sometimes switched on automatically. Three public examples:

• In September 2026, Microsoft announces in its Message Center the new version of Copilot in Outlook. It is enabled by default with the update, with no action from the administrator.
• Since August 17, 2026, Atlassian has applied new rules for contributing its customers' data to the improvement of its products and its AI. The starting setting depends on the plan subscribed.
• On September 16, 2026, Microsoft announces that new Copilot Business licenses bought from a reseller will include usage-based billing by default from November 2. On October 1, the date is pushed back to December 1, and France is excluded at launch.

None of this is hidden. Each change is documented, dated, and often adjustable. But someone has to read the announcement, understand that it concerns you, and decide. When nobody does, the feature is active in your company without anyone having chosen it. Ojja's public method calls this “enabled without a decision”.

Second door: the administrator #

Someone, in the IT department or at your service provider, enabled something. Twenty licenses for a pilot. A free trial. An application authorized for a team. An agent built by a department for its own needs.

Each of these decisions was legitimate. But they were taken one by one. The pilot was never closed. The person who launched it changed jobs. The licenses renew.

Third door: the employee #

The Banque de France notes it in its study of September 3, 2026: generative AI can be used directly by employees, through standardized tools. It is often talked about as misconduct. Above all, there are two very different mechanisms.

The first is the personal account. An employee opens a consumer assistant in their browser and pastes a work text into it. Nothing goes through your tools: you do not see it.

The second is the connected application. The employee clicks “Sign in with Microsoft” or “with Google”, then agrees to let the application access their email, their files or their calendar. If your directory settings allow it, access is open in ten seconds. This time, a trace exists: the company directory keeps the list of these authorizations. It is simply that nobody reads it.

In both cases, the employee acts in good faith. Nobody told them what was allowed.

What to count: five kinds of AI #

Your company's “AI” is not one tool. It is five kinds of objects, which do not come in through the same door.

An inventory done from memory often stops at the assistants, because they are the only ones that were bought knowingly. The rule is simple: one line per object, whatever the vendor and whatever the door.

Where to start on Monday #

Nothing that follows requires a tool or a budget.

1. Ask the three questions at your executive committee. Write down who answers, what they answer, and what remains unanswered.
2. Ask your administrator for the list of applications authorized on company accounts. It exists in your directory. Count the ones nobody recognizes.
3. Open the Message Center of your main suite. Count the month's announcements that mention AI, then the ones someone has read.
4. Appoint one person to keep the list. Just one.

You will not have an inventory by the end of the week. You will have a measure of what you do not know. That is the real starting point.