An organisation decides to get a grip on AI. An inventory is commissioned, run properly, with a survey across every department. Six weeks later there is a list of 34 tools, each with a risk rating and a recommendation.
On the day it is presented, it is already wrong. Not because the work was poor, but because the subject moves while you are looking at it.
Three mechanisms that age your list
Too many arrive. The There's An AI For That directory logs dozens of new AI tools daily and now lists tens of thousands. The exact figure matters less than the order of magnitude: no manual process keeps pace with that.
AI appears inside software you already have. The most awkward of the three, because there is no moment at which anyone requests anything. Your video-meeting tool started summarising calls last month. Your CRM drafts emails. Your PDF reader grew an assistant. No new procurement decision, therefore no new assessment, and the tool sits in your list described as it was two years ago.
Tools change hands. On acquisition the new owner inherits the users, the data and the ability to revise terms. Jurisdiction can shift, sub-processors can change, retention policy can move. In your list it remains the same row in the same colour.
Why more frequent inventories miss the point
The reflex is to raise the cadence: annual becomes quarterly. That helps marginally and does not solve anything, because you are now taking faster photographs of something that keeps moving.
The real problem is what you are measuring. An inventory tries to capture which tools exist or could be used. That set is effectively infinite and grows faster than you can track it.
What is finite is the set of tools actually being opened inside your organisation. In most organisations that is a few dozen, not thousands, and that list refreshes itself when you derive it from observation rather than from a survey.
What a survey misses
A further reason not to rely on a departmental round: people do not report everything.
Not out of obstruction. Research by KPMG and the University of Melbourne on trust in and use of AI found that 57 per cent of workers hide their AI use from their employer, and 48 per cent have put sensitive company data into public AI tools. A list built from what people volunteer is a list of what people are comfortable volunteering.
That is not an argument for more surveillance. It is an argument for asking a different question: not "what do you use", but "which services are being opened", with no person attached to the answer.
What to do about it
Three shifts.
Measure use, not existence. Which AI services are being opened in your organisation? That is observable without recording who does it: the domain alone is enough to know a decision is needed.
