The AI audit companies need

AI is spreading through companies faster than they can keep track of it. It comes in with software updates and with the tools employees pick for themselves. With it come gains, costs and legal obligations, and management often sees only part of each. An AI audit shows all three.

How AI gets into a company

Most business software is now rented as a subscription, and the vendor decides what goes into it.

Vendors across software categories are adding AI agents to their products to hold their ground against new AI-first rivals.¹

A company can log in one morning to find an assistant in its email client or an agent in its CRM. The feature can often be switched off, but only by someone who knows it is there. The vendor decided to add it. The data it works on is the company’s.

Employees add their own layer. Most people who use AI at work tried it at home first.² Many also trust their own judgment about it. Seven in ten office workers believe they understand AI better than their company’s tech team.²

A person who finds a tool that saves an hour a day tends to keep using it, approved or not. From the employee’s point of view, that is good work. For the company, it is unchecked software handling its data.

The result is three kinds of AI:

• One kind the company buys.
• Another arrives as a feature inside existing subscriptions.
• A third comes from home with the people who work there.

Each kind leaves a different trace. Purchases appear on invoices, bundled features in admin settings, and personal tools often only in the habits of the people using them. Management tends to see the first kind clearly and the other two in fragments. The first thing that gap hides is what AI is earning.

Gains that stay in one team

AI pays off where it takes over work that repeats. When a team discovers such a use by itself, the hours it saves stay inside that team. They rarely reach a report, and the next team with the same kind of work starts again from scratch. Across a whole company, those isolated savings add up.

The company owns a good idea without knowing it has one.

That blind spot shapes how companies judge AI. The ones that get the most from it share a habit. They check the return of each initiative regularly and move money away from the ones that disappoint.³ They learn what works one use at a time. That discipline needs a list to work from. An initiative has to be visible before its return can be checked.

Checking a return needs a before and an after. Most work already leaves traces in company systems, in timestamps, tickets, orders and invoices. Those traces show how a piece of work ran before AI arrived and how it runs now. They turn an impression of being faster into a number that can stand next to a cost.

What AI costs

The cost side has changed shape.

AI pricing has moved toward paying for what is used, so the price of a tool rises with every task it handles. For the finance team, a fixed line in the budget becomes a moving one.

A licence fee can be planned a year ahead. A usage fee depends on habits that change from week to week. Pricing models vary between vendors, which makes tools hard to compare.

Subscriptions also outlive their purpose. A tool bought for one project keeps billing after the project ends. When single teams buy their own AI tools, the number of such forgotten subscriptions grows with every team.

The largest cost may never reach an invoice. It is the time people spend reading, correcting and approving what AI produces.

It is also the time someone spends deciding which tools are allowed and watching how they are used.

A tool that saves an hour of writing and takes an hour of checking only breaks even. Heavy checking often points to a tool doing the wrong job.

What the law requires

Part of that oversight is mandatory. Data that staff paste into an outside AI tool leaves the company’s hands. The company’s duties under data protection law stay in place.⁴ A clear policy tells staff which tools and which data are safe to combine.

The AI Act adds a duty that marketing teams feel first. Some AI-generated images, video and sound must now carry a label. The duty covers content that resembles real people, places or things and could pass for real.⁵ Text written with AI to inform the public on matters of public interest carries the same duty. The exception is text that a person has genuinely reviewed and for which the company takes editorial responsibility.⁵ Correcting typos does not qualify as such a review.⁶ For marketing, that adds a check before each campaign goes out. Someone has to know which visuals were made with AI and whether they could be taken for real. Other duties concern people.

Companies that use AI must take steps to build their staff’s AI skills.⁷

AI that screens job candidates or manages employees comes under the rules for high-risk systems at the end of next year.⁸ Each of these duties applies to every AI use, including uses outside management’s view.

A snapshot to decide from

All three come back to knowing what AI the company has and what that AI does. An AI audit establishes this for one moment in time. It is a snapshot, and decisions start from it.

With that record in hand, a use that works in one team can spread to others. Forgotten subscriptions can end. Checking time can be weighed against the time AI saves. Gaps that matter to the law can be closed before they become a problem. The snapshot also separates the AI the company would choose again from the AI it inherited. Management then decides about AI with the full picture in front of it.