Choose information sources deliberately.
Start with employee declarations, application owners, procurement records and supplier discussions. Ask about AI features inside existing products as well as standalone services. Agree the scope and permissions for any technical discovery before it begins.
Different sources reveal different things. A purchase record may identify a subscription but not its actual use; a staff survey may explain the task but miss unmanaged accounts. Record those limitations when reporting coverage.
Ask questions people can answer.
Use ordinary language: which task does the tool help with, what information is entered and what happens to the output? Ask who owns the activity and whether an approved alternative exists. Explain why the information is being collected and where questions can be raised.
Avoid collecting passwords, unnecessary prompt histories or personal files. Discovery should establish enough context for review while respecting the agreed privacy and access boundaries.
Separate a finding from its eventual decision.
A newly discovered tool is not automatically approved, prohibited or high-risk. Identify the facts and route the use for the appropriate review. Prioritise unclear supplier arrangements, sensitive information and outputs affecting significant decisions.
- A use-case description and responsible owner.
- The source and confidence of the finding.
- Relevant supplier and information-flow details.
- The next review action and any interim restriction.
Report what is known and what remains unknown.
A credible discovery summary states which teams, systems and sources were included, when they were checked and which gaps remain. Deduplicate repeated tool names without losing distinct business uses. Assign unresolved findings so the discovery exercise leads to decisions.
EUAIC can help scope the intake and follow-up workflow. Automated discovery or enforcement requires a separate specification and authorisation. The public website does not install an agent or provide permission to monitor employee activity.