Policy GeneratorFind every AI tool your organisation is already using.
Almost every organisation under-counts, and not by a little. This is the afternoon’s work that fixes that — six places to look, the two emails that do most of the work, and a register to write it all down.
Yours to use, copy and pass on — including with your own clients.
Six places to look
In rough order of what they turn up. The first finds more than the rest combined.
- Ask your IT provider or IT contact
The highest-yield single step. Most AI in a small organisation is already inside software you pay for — it just needs switching on or has been switched on by default. Use the email below.
Usually turns up: Copilot, Gemini, Slack AI, Einstein and anything connected to your systems
- Check the connected-apps list
In Microsoft 365 (Entra ID → Enterprise applications) or Google Workspace (Security → API controls), there is a list of apps authorised to reach your email, files or calendar. Tools nobody remembers approving show up here.
Usually turns up: Note-takers, meeting bots, CRM add-ons, browser extensions with account access
- Look at card statements and expense claims
Search the last twelve months for recurring charges under about €50 a month. Individually they look trivial; together they are your shadow IT estate.
Usually turns up: Personal subscriptions expensed by staff — the highest-risk category
- Check meeting invitations for bots
Look for attendees you do not recognise on recent calls — recording and transcription bots join as participants and are often invited once and then forgotten.
Usually turns up: Otter, Fireflies, Read.ai and similar
- Ask your team directly
Nothing else finds tools people use on personal accounts, and that is precisely the category that matters most. Frame it as safety, not enforcement — the email below does.
Usually turns up: Personal-account ChatGPT, image tools, anything used quietly to save time
- Check browser extensions on shared machines
Extensions with page-reading permissions can see whatever is on screen, including customer data. Worth a look on any shared or reception machine.
Usually turns up: Writing assistants, summarisers, autofill tools
Too big to look yourself?
Above roughly fifty people, no one person knows what marketing bought or what HR is trialling. Delegate it — one owner, ten working days, and nil returns asked for explicitly.
| Ask | What it usually turns up |
|---|---|
| Finance / bookkeeping | Personal-account tools bought on cards and never registered |
| HR / People | CV screening and candidate ranking — high-risk under the AI Act — deal with this one first |
| Sales / Business development | Prospecting databases, CRM assistants, email writers, call recorders |
| Marketing | Generated media — which must be disclosed under Article 50 |
| Customer support | Chatbots and reply suggestion — customers must be told they are dealing with AI |
| Operations / Admin | Note-takers and meeting bots, usually invited once and forgotten |
| Whoever administers Microsoft 365 or Google Workspace | The single largest source, and the one nobody thinks to check |
Once you know what you use
Entering what you found turns the list into a living register — and the AI policy and EU AI Act assessment are generated from it, naming your actual tools rather than a stock list.