Every use of AI in a company should earn its place. It should run under control, comply with the law and return more than it costs. The audit checks every use against all three and ends with a decision on each.
A breinz AI audit examines how AI actually works inside an organization. We measure what we find against three benchmarks:
The audit covers every use of AI. That starts with AI the company approved and bought. It also takes in AI that employees use on personal accounts, and AI that vendors have added to software the company already pays for.
The market splits this work across three kinds of service. None of them gives the full picture.
The breinz audit brings control, law, technology and data, software and AI spend, and actual return together in one examination.
At breinz we see AI as part of the whole company. It reaches every area of the business, each in a different way. AI is software. The company buys it, runs it and answers for it. So for every use of AI the audit asks the same four questions.
But looking at control alone gives an incomplete picture. AI can be under full control and still fall short of the business results expected of it. Return without control, in turn, means risk that the business has not identified.
A breinz AI audit across the whole company gives an honest answer to whether something is worth doing. That answer takes the form of a decision. Each use of AI can be kept, formalized, extended, put on hold or blocked. For a planned rollout, “don’t deploy” is a valid result in its own right. We treat AI models, systems and AI features as interchangeable engines. That keeps the audit independent of any vendor.
Every company that runs on IT systems has AI today, including AI it never consciously decided to adopt. Software vendors are building AI agents into products companies already use, and companies increasingly rely on those built-in tools.1 Employees bring in AI as well. Two thirds of office workers at large companies have used AI tools they believed were banned.2 Nearly nine in ten employees who have a company AI tool also use a personal one. Network traffic measurements show that two thirds of AI users connect through personal accounts on company devices.3 A picture of AI built on what people report, or on the IT department’s list, is incomplete by its nature.
The number of such incidents quadrupled in a year.3 Rules lag behind practice.
AI connected to email, ERP or CRM acts with the company’s permissions. Its mistakes land on the company, whatever the vendor promises. Risk is also rising from outside. With AI, a working attack on widely used software can now be built in about ten hours, work that used to take weeks.6
For the business, the benefits of AI systems are only half the picture. The other half is what they cost to deploy, run and maintain, including building and running the controls around them.
AI speeds this up as it enters organizations. Across $75 billion of software spend tracked by one management platform, spending on AI-native apps rose 108% in a year. In organizations with more than 10,000 employees it rose almost fivefold.9
AI pricing models vary across the market. A lot of AI is billed by usage, in tokens and credits. These charges turn into hidden commitments.
The AI market is young compared with the software market. Many companies are still experimenting with AI and have yet to run it as part of everyday operations. The economics often take a back seat.
Return on AI depends on the foundations it rests on. Mid-sized companies name four main barriers.
The audit examines each of these in the client’s own company. It checks which data AI works on and how accurate it is. It tracks what data leaves the company and where it goes. It maps which core systems AI can connect to. It finds out who has the skills to use AI and check its output. Only one organization in three says it trains all its employees in AI.5
Since 2 August 2026, EU transparency requirements have applied, including labelling of AI-generated content. Companies must also support their employees’ AI literacy.13
ISO/IEC 42001 is voluntary, but it sets the market benchmark for showing that a company is in control of its AI. In practice the standard calls for a register of AI systems with purpose, owner and data, an assessment of risk and impact on people, a person authorized to stop a system, and records of human reviews.16
These challenges rest on one premise. A company can’t control AI it can’t see, pay sensibly for it or prove that it complies with the law. So the audit starts with full visibility, an inventory of every way the organization uses AI, including through third parties. In the end it is the company, and not the vendor, that answers for what AI does.
The audit is made up of key analytical modules.
Does the company have rules for AI, and do they work in practice? We review the AI policy and compare it with how AI is really used. We establish who makes decisions about AI and how a new tool gets approved. We look at how the company assesses AI risk and handles incidents. We also review contracts with AI vendors to see what each vendor may do with company data and what it answers for. Most AI reaches companies through vendors.
The inventory establishes what AI the company has. It covers approved and unapproved tools, personal accounts used for work, AI features switched on in existing software, and agents and automations that teams built themselves. For each use we record the purpose, owner, status and the data it works on, as ISO 42001 requires.16
This module traces which processes and decisions AI takes part in, and which steps it performs. We measure how those processes run in terms of cycle time, error count and the number of handoffs between people and systems.17 We establish where AI hands a case over to a person, where it stops because it was designed to, and where it fails because a connection broke or it received data it can’t process. This distinction comes from breinz practice. Designed stops show control. Failures nobody notices show its absence.
This module examines the data AI works on. We check its accuracy, its owner and whether its origin is recorded.18 We establish whether AI answers from verified knowledge the company controls, or from random files and the generic knowledge a language model picked up in training. We also follow data in the opposite direction and track what leaves the company through personal AI accounts and to vendors.
This module maps which company systems AI is connected to and through which interfaces. It also checks whether core systems such as CRM, ERP and HR have such interfaces at all.18 For each AI tool we compare its permissions with what its task actually needs. We check whether AI runs within the company’s existing user profiles, permissions and event logs. We establish which AI actions need human approval, who reads the record of what AI did, who can stop it mid-task, and whether it has been tested against failures and attacks. We also assess how exposed AI-connected systems are to attacks built with AI.
This module looks at who in the company uses AI, for what and how skilfully. We also establish what training the company provides. The module covers the impact of AI on employees and job candidates as well, which ISO 42001 requires and the high-risk rules address.16 14
This module sets the way AI is used against the obligations of the EU AI Act. These are labelling content, supporting employees’ AI literacy and classifying high-risk uses. The module checks compliance with the GDPR and with national law in key European markets. For Poland, Germany, France and Spain that means their data-protection acts. For Italy it means the Personal Data Protection Code and the national AI law, Law 132/2025.19 For the UK it means the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.20 The module also covers legal safeguards that must work inside the systems themselves, such as retention limits for personal data or automatically generated legal notices. breinz builds such safeguards into its own deployments, so the audit verifies their configuration and execution logs like in any other system.
This module builds a complete list of software and AI, including what was bought outside IT. It identifies unused licences, overlapping tools, and integrations and bots that nobody uses but that still run on paid plans.21 Usage-based AI charges are counted separately. The module also counts the time employees spend checking AI output, a cost that usually goes unnoticed. That time is part of what AI really costs.
This module answers the question the market most often skips. For each use of AI we establish what it delivers in the client’s own numbers, in time saved, fewer errors and lower cost. We then set that against its full cost. The result separates AI that earns from AI that only costs.
The audit draws on three sources of evidence. They are the data the company already holds, its documents and its people. Each source shows a different side of how AI works in the company, and the verification stage checks them against one another.
A typical breinz audit takes six to eight weeks, depending on the size of the organization and the number of AI uses it finds.
Every process exists in three versions.
One is written in the procedures, one is described by people and one shows up in system records. These versions rarely match.
Where they differ, the records decide, and the gap itself becomes an audit finding. Each use of AI is scored in a risk matrix by data sensitivity, data sent outside the company, control over the vendor and how far work depends on the tool.22 We add a legal compliance score and a return score.
We present findings to management directly, including when the result is blocking a tool or dropping a planned deployment.
The audit continues beyond the report and its list of recommendations. We recommend a quarterly check on how the recommendations are being implemented, with a fresh look at problem areas.22 Control over AI is ongoing work, because AI in software and in employees’ hands changes month to month.
After the audit, the company sees all the AI it uses. Each use has an owner, a cost and a decision.
The scorecard shows where the organization stands with AI. It rates the organization across the nine dimensions of the audit, from governance and accountability to return, against the company’s own goals, legal requirements and ISO 42001. The board can see in one place where the company is ready for more AI and where it must first fix the foundations.
The register is the core document of the audit. It lists every use of AI in the organization with its type (tool, feature in existing software, agent, automation and so on), department, purpose, owner and approval status. For each use it also gives the input data, connected systems, scope of permissions, monthly cost, return score, risk score and compliance score. The register meets ISO 42001 requirements for an inventory of AI systems, so it can become the starting point for certification if the client wants it.16
Every tool gets one of five decisions. It can be kept as is, formalized (brought under the official rules), extended to more teams, put on hold or blocked. Each decision has a rationale, an owner and a deadline.22
The report describes every gap in control over AI, with evidence from records, a risk score and the role or person assigned by management to close it. Legal gaps are listed separately. They are measured against the EU AI Act, the GDPR and national laws in key European markets. These include Poland’s Personal Data Protection Act, Germany’s Federal Data Protection Act (BDSG), France’s Data Protection Act (Loi Informatique et Libertés) and Spain’s Organic Law on Data Protection (LOPDGDD). For Italy they include the Personal Data Protection Code and the national AI law, Law 132/2025.19 For the UK they include the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.20 Each legal gap comes with the date from which the obligation applies.
The report gives the full list of paid software and AI, including what was bought outside IT. It shows the recoverable amount for each tool, calculated as unused seats times the seat price, plus the cost of overlapping tools and unused integrations.21 It also shows usage-based AI costs and the working time spent checking AI output.
The baseline records the starting point for costs, cycle times, error counts and handoffs in the processes where AI works. It is measured on the client’s data, so every later effect can be compared against it, whether it comes from audit decisions or from future deployments.
The roadmap puts actions in order. Critical gaps are fixed first, then tool decisions are carried out, and new AI uses come last. Each step has an effort, return, risk and compliance score and a clear yes or no decision. The roadmap carries a 12-month return forecast in three scenarios (conservative, likely and optimistic).17 It also points to data and expert knowledge the company already has that AI can use. In the breinz approach every deployment should leave behind an asset that keeps gaining value. The first step is described in enough detail to start building within a few weeks.
The presentation summarizes findings, decisions and the roadmap in a form leadership can base budget decisions on.
Periodic reviews are optional. One of the audit’s recommendations can be a framework the client uses to run its own reviews. Reviews track progress through indicators. These include the share of tools formalized or blocked, the drop in personal AI use, the number of data incidents, the amounts recovered and the change in measured process results against the baseline.22
With that, the company can keep AI under control, spend wisely and show it follows the law. It has always answered for its AI.
Now it knows what that covers.
Sources: