The 20-minute AI tool inventory every SME should have done by February
You cannot write a policy for tools you cannot name. Here is the short version of the exercise, and the three places the surprises usually hide.
The EU AI Act’s AI literacy obligation applies from 2 February 2025, and it is the one clause that reaches ordinary companies rather than model builders. You cannot brief people on tools you cannot name. So the first task is an inventory, and it is genuinely a 20-minute job.
The exercise
Open a spreadsheet. Four columns: tool, who uses it, what data goes in, who approved it. Fill it in from memory first, then check the three hiding places below.
Do not aim for completeness on the first pass. A list with eight entries that exists beats a perfect list that does not.
Where the surprises are
1. Features inside software you already bought. Nobody procured these, so nobody lists them. Your mail client summarises threads. Your video tool writes meeting notes. Your design tool generates images. Since 28 October, the phones run Apple Intelligence. These are AI tools processing company data, whatever the invoice says.
2. Personal accounts used for work. Someone is pasting a customer email into a free chatbot on their own login because the work tool is slower or does not exist. This is the largest category and the least documented. Ask without blame — people answer honestly when the question is framed as inventory rather than investigation.
3. Browser extensions. Grammar checkers, summarisers, transcript grabbers. They see everything on the page, including the CRM record open behind them, and they were installed in four seconds without an approval step.
What to do with the list
Sort it into three piles: fine as is, fine with a rule, not fine. Most entries land in the first pile. Say so out loud, because a review that only produces prohibitions teaches people to stop mentioning tools.
For the middle pile, write the rule in one sentence each. For the third, offer a replacement before you take something away; removing a tool without providing an alternative just moves the activity somewhere you cannot see.
Then date the document and put a reminder in six months. That is the whole exercise, and in February it will be the evidence you needed.