To audit AI tool sprawl, list every AI tool your team uses (paid, free and built into other software), record who uses it and what data goes in, compare tools that do the same job, then keep, merge or retire each one against a clear reason. Do this for cost, but also for risk: unmanaged tools are where business data quietly ends up in places nobody chose.
Why sprawl happens
AI tools are cheap to start and easy to adopt without asking. One person trials a writing assistant, another subscribes to an image generator, a third enables an AI feature inside software the business already uses. Within months a team can hold several overlapping subscriptions, some on personal cards, some on free tiers, with nobody holding the full picture.
The result is rarely a single big problem. It is accumulated small ones: duplicate spending, inconsistent output, unclear data handling and no plan for what happens if a vendor changes its terms or closes.
Step 1: Build an inventory
You cannot manage what you cannot see. NIST’s AI Risk Management Framework, a voluntary framework, treats this as foundational: its Govern function includes the aim that organisations have mechanisms to inventory AI systems, resourced according to organisational risk priorities. You do not need a formal framework to apply the idea. A spreadsheet is enough.
Capture, for each tool:
| Field | Why it matters |
|---|---|
| Tool and vendor | Identifies what you actually use |
| Owner | Someone accountable for it |
| Plan and billing method | Finds personal-card and forgotten subscriptions |
| Users and how often they use it | Shows real value versus licences paid for |
| Task it supports | Enables overlap comparison |
| Data entered (customer, staff, financial, none) | Drives the risk review |
| Renewal date | Gives you the exit window |
| Is it standalone or a feature inside other software? | Embedded AI is easy to miss |
Sources for the list: finance records and card statements, software admin consoles, a short staff survey with a no-blame promise, and a check of AI features switched on inside your existing tools.
Step 2: Find the overlap
Group tools by the job they do rather than by vendor: drafting text, image creation, transcription, meeting notes, customer chat, data analysis, coding assistance. Within each group ask:
- Are we paying for two or more tools that do essentially the same thing?
- Does a tool we already own include this capability?
- Is the output good enough that people actually use it, or does it sit idle?
- Would one tool with better controls serve everyone?
Overlap is not always waste. Different teams can have legitimately different needs. The goal is a reason for each tool, not a single winner.
Step 3: Review the data risk
This step matters more than cost. For every tool, establish what data goes in and what the vendor does with it. The questions to ask:
- What information do staff enter: customer details, contracts, financial figures, unpublished plans?
- Does the vendor’s account type allow the data controls you need, or is the tool running on a personal or free account?
- Is data used to train models, retained, or shared, and can you turn that off?
- Where is data stored and processed?
- Who in the business can see another person’s inputs and outputs?
Treat the answers as a risk rating: no sensitive data, internal data, customer personal information, or highly sensitive. Tools handling personal information deserve the closest review, including a check against your privacy obligations. In Australia, the Privacy Act and the Australian Privacy Principles apply to many organisations; take professional advice on your obligations, since this article is general information, not legal advice.
NIST describes its Map function as setting the context for a system’s risks, gathering information needed to anticipate negative impacts and to make an initial decision about whether to proceed. A lightweight version works here: for each tool, write down its intended purpose, who is affected by its output and what could go wrong.
Step 4: Decide keep, merge or retire
Use a simple rule for each tool.
- Keep if it has a named owner, a clear purpose, real use and an acceptable data profile.
- Merge if another tool already covers the job. Move users, then cancel.
- Retire if it has little use, no owner or unacceptable data risk.
- Restrict if it is useful but only suitable for non-sensitive material. Write the limit down.
Record the reason in the inventory. That record becomes your policy basis.
Step 5: Plan the exit before you commit
Each tool you keep should have an exit plan, because vendors change prices, terms and features. Check whether you can export your content, prompts, templates and history in a usable format, how long data persists after cancelling and whether your workflow depends on features that could be withdrawn. If a tool is embedded deeply in your processes, note a fallback. Our article on build versus buy for AI tools explains how dependency changes that decision.
Step 6: Set simple rules so sprawl does not return
An audit is a snapshot. To keep it that way:
- Require a short approval for any new AI tool, even a free one.
- Give people an approved list and a quick path to ask for more.
- State what must never be entered into unapproved tools.
- Review the inventory on a fixed schedule, such as twice a year and before renewal dates.
- Keep a human check on AI outputs that reach customers. See human-in-the-loop workflows.
Measure value as well as cost. Our AI return on investment framework shows how to compare what a tool saves against what it costs to run and govern. NIST notes that the AI RMF is intended for voluntary use, so adopt only as much structure as your size justifies.
Limits of this approach
A tidy inventory does not prove tools are safe, only that you know what exists. Staff may still use tools off the books, so make the approved route easy, not punitive. Savings may be modest, since the biggest gain is often reduced risk and clearer ownership rather than a large cost cut.
Where Radiance Impact fits
Radiance Impact combines creative production, AI and digital technology, and works with businesses on practical frameworks for adopting AI. If you want help structuring an AI tool review or workflow, contact us or read about Radiance Impact.
Sources
- AI RMF Core, NIST AI Resource Center
- AI Risk Management Framework, NIST AI Resource Center
