The shadow AI census: eleven tools, IT knew about four.

When we set up a brand contract, the first step is an inventory: which AI tools does this marketing team actually use? At one recent intake the census found eleven. The IT department knew about four.

That gap is the census in one line, and it recurs — in both directions. Teams underreport because half the tools feel too small to mention: the browser extension that rewrites, the deck plugin that generates, the free tier someone tried in March and never left. IT undercounts because procurement only sees what gets invoiced.

How the census works

• Per team, per intake. We inventory at the start of every contract-setup programme: what is used, by whom, for what, with which material.
• Tools, not licences. A free tier counts. A personal account used for work counts double.
• Counted, then published in aggregate. Individual intakes stay confidential; the aggregate publishes as counts once it clears ten intakes, per how we count. [ aggregate table follows ]

Why this is a governance gap, not a people problem

Nobody in that team was being reckless. Every tool solved a real problem, faster than the official route. Shadow AI is what a motivated team does when the governed path is slower than the ungoverned one — blocking tools does not fix that, it just moves usage to personal devices.

The fix that works is making the governed path the fastest one: one workspace where every model is available, every output is checked against the brand contract, and the gate takes one click. Then the census stops growing — not because people stopped wanting tools, but because the sanctioned one stopped being the slow one.

Run your own census

Ask each team member to list every AI-touching tool they used this month — anonymously, amnesty declared upfront. Compare against what IT can see. The distance between those two lists is your actual exposure, and it is almost always wider than either list alone suggests.