How do I discover unapproved AI tools employees are using and build an AI inventory?

Shadow AI — employees and teams using AI tools nobody approved — is now a legal exposure, not just an IT annoyance: an AI inventory is the starting requirement of essentially every framework, from the EU AI Act to NIST AI RMF. How to find it: 1. Traffic discovery: AI-traffic security tools identify which AI services your organization actually talks to — WitnessAI monitors employee AI usage, Aurascape decodes AI app protocols natively, Cisco AI Defense includes AI asset discovery. 2. Expense and SSO sweep: cross-check SaaS spend and identity-provider logs against known AI vendors; the gap between the two lists is your shadow inventory. 3. Register everything: move findings into a governed inventory — Credo AI and Trustible are built for exactly this registry function. 4. Set the policy before enforcing it: an amnesty period beats a ban; bans create better-hidden shadow AI. Then keep the inventory alive: re-scan monthly, because the tool list your employees use changes faster than your policy does.