Find the AI risks already inside your business
An AI policy is difficult to apply when nobody has a clear picture of the tools in use. Begin with the work people are doing, including AI features inside existing software, and identify where those uses affect customers, information or important decisions.
Editorial responsibility: Nardus Oelofse, Chief Consultant.
By Chase & Marshal
Ask about work rather than product names
People may not describe a writing assistant, meeting summary or recommendation feature as an AI system. Ask how they prepare documents, research customers, analyse information and make decisions. Include tools purchased by individuals and features already enabled in business platforms.
Make the discussion practical and constructive. The purpose is to understand use and improve decisions. If every disclosure feels like an admission of wrongdoing, useful information will remain hidden and the inventory will be incomplete.
Record enough to make a decision
For each use, record the task, owner, users, information involved and destination of the output. Note whether a person checks the result and whether the tool can take an action, such as sending a message or changing a record.
A short inventory is more useful than a long policy with no connection to actual work. It lets you distinguish a low-consequence drafting aid from a system influencing a consequential customer or employment decision. The same product can carry different risks in different tasks.
Prioritise by consequences and control
Consider what could go wrong, who could be affected and how quickly a problem would be noticed. Then examine the controls that actually operate. A review checkbox offers little protection if the reviewer cannot see the source information or lacks time to check it.
In an illustrative sales team, summarising approved meeting notes may be manageable with a review step. Automatically changing customer terms from an AI recommendation needs much tighter authority and verification. Assess the workflow rather than assigning one risk label to every AI tool.
Turn the inventory into operating rules
Give each use a clear decision: allowed, allowed with conditions, awaiting review or unsuitable for the proposed task. Explain the conditions in language a user can apply. Name the person who can approve a new use and the route for reporting an incident.
Review the inventory when a tool gains new access, starts taking actions or is used for a different purpose. Governance works best as a maintained set of decisions connected to the business, with a manageable rhythm of review and visible ownership.
Questions answered
Do we need an inventory for tools we already pay for?
Include AI features within existing software. The relevant questions are what the feature does, what information it uses and how the result affects the business.
Related
Sources
Sources supporting the factual statements in this article. Findings should be read within their stated dates, geography and scope.
- Helping Kiwi businesses succeed - Business.govt.nz. www.business.govt.nz. Publication date not supplied.
- Office of the Privacy Commissioner | Homedown arrow. www.privacy.org.nz. Publication date not supplied.
Make your AI use visible
If AI use has grown faster than your oversight, we can help map the current position and turn it into a practical set of responsibilities and decisions.
