AI tool sprawl and how it happens without anyone deciding

5 days ago
3 min read

Updated: 3 days ago

Introduction

Nobody decides to hold seventeen subscriptions. Each one was individually sensible: somebody needed transcription, somebody else wanted a better writing assistant, a third person signed up for a scheduling tool during a busy week. All were cheap, several were free at the point of adoption, and none went through any process because there was no process.

Two years later the business is paying for overlapping products, company data sits in a dozen services nobody has inventoried, several accounts belong to people who have left, and no one can say what is being used for what. The cost is annoying and the data exposure is the real problem, because you cannot protect information when you do not know where it is.

1. AI tool sprawl and how it happens starts with low individual cost

Below the threshold of attention.

A subscription under a certain amount does not require approval anywhere, so it does not get any. Twenty of them together would never have been approved as a single decision, and that decision was never presented.

2. Free tiers are the main entry point

And the highest risk.

Somebody uses a free account for work material. There is no contract, no data processing arrangement, and frequently different terms about whether content is used for training. This is the most common serious exposure and it is invisible.

3. Start with an inventory rather than a policy

Find out what exists.

Card statements, expense claims, browser sign-ins, and simply asking people without any implication of blame. The list is always longer than expected, and it is the necessary basis for anything else.

4. Ask what each one is actually used for

Duplication is the usual finding.

Three products doing the same thing because three people solved the same problem separately. Consolidating these reduces cost and, more importantly, reduces the number of places your data sits.

5. Find the accounts registered to individuals

The continuity risk.

Subscriptions in a personal name, paid on a personal card and reclaimed, or tied to a personal email. When that person leaves, the business may lose access to the data or continue paying for something nobody can reach.

6. Introduce a light approval route rather than a ban

Bans produce concealment.

A quick way to request a tool, with a clear answer, keeps adoption visible. Prohibition drives it onto personal accounts and personal devices, which is the outcome you were trying to avoid.

7. Publish an approved list

The practical mechanism.

A short list of products people may use for particular purposes, with the account arrangements already in place. Most sprawl is people solving a real problem without knowing what is already available.

8. Review the whole list annually

The maintenance step.

Usage, cost, overlap and whether the data terms have changed. Vendors change their terms and their pricing, and a product that was appropriate two years ago may not be now.

9. Have a leavers process that covers these accounts

The gap in most offboarding.

Access removed, ownership transferred, data exported. Standard offboarding covers the main systems and misses the twelve smaller ones, which is precisely where individually held accounts are.

The data protection position matters here. Where personal data is being processed through a service the business has not assessed and has no arrangement with, the obligations may not be met, and the requirements vary by jurisdiction. An inventory is the first step towards knowing.

Conclusion

Inventory before you police, because you cannot protect data in places you have not identified.

Recognise that low individual cost and free tiers are how it starts, ask what each product is actually used for and consolidate the duplicates, find the accounts registered to individuals rather than to the business, introduce a quick approval route instead of a prohibition, publish an approved list so people stop solving the same problem separately, review cost, overlap and data terms annually, and extend your leavers process to cover every account.