The annual review of your AI tools
Most companies have been using these tools for about a year now. That is long enough for a list to have gone stale in three specific ways.
If you started using AI tools in earnest around autumn last year, you are due a review. Not a strategic one — an inventory. It takes ninety minutes and catches three things that reliably go wrong in the first year.
One: accounts belonging to people who left
The most common finding, and the most boring. Someone signed up with a company card, left in March, and the subscription is still charging and their account still has access to whatever it was connected to.
Check the card statement, not the tool list. The tools you know about are not the problem.
Two: connections nobody remembers granting
A tool that was given access to your mailbox or your file storage during a trial in February still has it. The trial ended; the permission did not.
In your Microsoft or Google admin console there is a list of applications with access to company data. Read it. In our experience there are usually two or three entries nobody can identify, and removing them costs nothing.
Three: settings that were reset by an update
This is the one people do not expect. A setting you turned off in March can come back on after a product update, particularly when a vendor restructures its AI features — which most did this year.
Re-check the four settings from the 20 August post rather than assuming your earlier decision held.
Make it annual, and put it somewhere
Same month every year, one person, ninety minutes, and a note of what you found. If you named an owner after the 8 September post, this is their job and it belongs in their calendar now, for September next year.
None of this is exciting. It is also the only part of AI security a company your size can realistically do well, and doing it well genuinely matters.