Intake that surfaces shadow AI

Every other obligation is downstream of the register. A firm that cannot list its AI systems cannot classify, assess, monitor or document them, and cannot answer the first question any supervisor or auditor asks. FINMA's guidance puts an inventory of AI applications at the head of its expectations, and the model risk and NAIC regimes both expect an inventory covering systems in use, recently retired and under development.

The hard part is not building the register. It is building intake that catches what nobody submits.

Four routes in, and only one of them is a form

Project intake. The route everyone builds. A team proposes a system, completes a form, and enters the pipeline. It catches deliberate, funded, centrally visible work, which is a minority of the estate in most firms.

Procurement intake. A trigger on any purchase of software, professional services or data. The question is not "are you buying AI", which invites a confident no. It is a set of behavioural questions: does the product generate text, images or audio; does it score, rank, match or prioritise anything; does it make or recommend decisions about people; does it summarise or classify documents. Those get honest answers because they describe what the buyer wants the product to do.

Vendor change intake. The route almost nobody builds, and the one that catches the most. AI features arrive by release note in products already licensed, with no purchase event and therefore no trigger. Someone has to read release notes for the material platforms, on a schedule, with a duty to raise a register entry. It is unglamorous and it is the difference between a register that reflects the firm and one that reflects its project portfolio.

Discovery. Network and SaaS telemetry showing traffic to model APIs and consumer AI services. Expense data showing personal subscriptions reclaimed. Both find real systems, and both should be framed internally as intake rather than enforcement, because a discovery programme that is experienced as surveillance produces better hiding rather than fewer systems.

Why shadow AI is a governance failure before it is a staff failure

People paste customer material into public assistants because it works and because the approved path is slower or does not exist. Treating that as a discipline problem produces a policy nobody reads and behaviour that moves off the corporate network.

The two interventions that work are unrelated to policy. Provide a sanctioned tool that is good enough for the actual task, and make registering something take minutes rather than a quarter. A register entry that requires a completed risk assessment before it can be created is a register that will not be told about anything.

So intake should accept an entry with very little: what it is in one sentence a non-specialist understands, who owns it, what data goes in, and where the output goes. Classification and assessment follow. The register's job at intake is to know the thing exists.

What an entry carries

System name and internal identifier. Business owner and technical owner, as a role and the person holding it. What it does, in one plain sentence. Whether it is built in-house, bought, or embedded in a purchased product. Your role per regime: provider, deployer, importer, distributor. Component objects governed in their own right, which means models, prompts, datasets and agents, not just systems. Third-party models and services it depends on. Lifecycle stage: proposed, in development, live, suspended, retired. Date entered, date last reviewed, date retired. And links to the classification, assessment and documentation for that entry.

Two entries deserve emphasis. Registering prompts, datasets and agents as objects in their own right catches what a system-level list misses, which matters increasingly as agentic deployments spread. And retired entries are retained rather than deleted: a system switched off last year can still be the subject of a complaint, and several regimes set multi-year retention, with Colorado SB 26-189 requiring three years.

Reconciliation

Continuous intake with a full reconciliation quarterly. The reconciliation is where the register is compared against sources it did not come from: the software asset inventory, expense data, the vendor release notes reviewed that quarter, and the list of systems each business unit believes it runs. Discrepancies are the output, and they should be reported to the committee rather than quietly fixed, because the trend in discrepancy volume is the honest measure of whether intake is working.

Worked example: the register that grew by forty per cent in one quarter

A private bank's register holds twenty-two entries after a year of project-based intake. Governance then adds three things: a set of behavioural questions in the procurement workflow; a monthly review of release notes for the eleven platforms the bank considers material; and an amnesty announced by the COO, giving six weeks for anyone to register AI use with no consequence attached.

The register reaches thirty-one entries. Nine new systems: four AI features enabled by vendor updates in the CRM and the document management platform; two consumer assistants used by relationship managers for correspondence drafting; a pricing tool inside a market data product; a transcription service used in client meetings; and a recruitment screening tool a hiring manager had trialled for two months.

Two of the nine turn out to matter a great deal. The recruitment tool sits in the Annex III employment and worker management category. The transcription service processes client conversations, which raises both data protection questions and the Article 50 duty to inform people they are interacting with an AI system.

Neither would have been found by a better form. Both were found by asking different questions of different people, and by making it safe to answer. The amnesty is the part firms resist and the part that works, because the alternative is a register that is accurate about the systems governance already knew about.

As of 24 September 2026.