Unauthorized AI Discovery and Regularization Program

How to use this document

• What it is for. This is a base procedure to discover the use of AI tools, extensions, accounts and models that did not go through the organization's approval, open a no-sanction regularization window, decide case by case and publish a catalog of authorized tools by data type. Its aim is to know about and channel real use, not to punish it.
• Who should own it. The AI lead, with information security for technical discovery and with Human Resources and legal for communications and consequences. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide which discovery methods you will use (section 6) and on what internal basis, how long the regularization window lasts (section 7), which tools go into the initial catalog (section 5) and how often recurring discovery runs (section 12).
• Module selection. Choose the level (Basic, Standard or Reinforced) in "Module selection".
• Fields to complete. Replace the bracketed text and complete the catalog in section 5 with the tools already approved in the "AI System Inventory".
• Review. Have legal or your advisor and Human Resources review the discovery methods and the communications before using them: monitoring of staff activity is limited by each country's employment and data protection rules, and may require informing staff or their representatives in advance.
• Approval and publication. Have the AI committee (or management in a small organization) approve the program, record the approval in "Version history" and announce the regularization window with the model message in aid F.

Module selection

Level	What to keep
Basic (under ~50 people, commercial tools only)	The core procedure without the [STANDARD LEVEL] and [REINFORCED LEVEL] paragraphs; discovery through the survey, expense review and connected apps; a single regularization window; aids A to G
Standard	Core plus [STANDARD LEVEL] paragraphs: periodic technical discovery and quarterly metrics
Reinforced (regulated sector, special-category data or profiles P3 to P5 in production)	Core plus [STANDARD LEVEL] and [REINFORCED LEVEL] paragraphs: continuous discovery, data loss prevention and technical blocking by default

Delete the paragraphs that do not fit the chosen level.

Unauthorized AI Discovery and Regularization Program

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Program owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Self-reporting channel	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 [ORGANIZATION NAME] sets up this program to identify AI use that has not been approved, reduce the exposure of data and of the organization that such use may cause, and offer staff authorized alternatives.

1.2 The program starts from the view that unauthorized use usually reflects a real need. It therefore combines discovery with a simple way to declare and regularize use, and with a clear catalog of what is allowed.

2. Scope

2.1 Unauthorized AI is any AI tool, feature or model used with the organization's information or in its processes that is not recorded as approved in the "AI System Inventory", in particular:

a) generative AI assistants used with personal accounts or consumer plans;
b) browser extensions, office add-ins and mobile apps with AI features;
c) AI features turned on in software already licensed without prior assessment;
d) third-party apps granted access to corporate accounts (email, calendar, documents, repositories);
e) AI subscriptions or APIs paid with corporate cards, expense claims or small purchases;
f) AI models downloaded and run on the organization's devices or servers, including open-weight models and the software used to run them locally;
g) AI agents and automations built by staff on low-code platforms.

2.2 It applies to all staff, contractors and vendors with access to the organization's systems or information.