Pillar 02 · Scope
S3 SaaS AI Discovery Checklist
The AI you didn't approve is already switched on.
Form Document
What it's for
Vendors add AI features to the tools you already own. An update switches one on by default, or one admin enables it for everyone. These features read mail, documents, CRM records and meeting recordings, and none of them came through your AI intake, so none of them are in the register.
The framework's Scope chapter asks for periodic discovery scans to find this unregistered AI use. This checklist is that scan: where to look, what to ask about each feature you find, and what to decide.
What you get
- Where to look Nine places unregistered AI shows up
- For each AI feature you find Seven questions
- Decide Four outcomes
- Discovery log What this scan found
How it connects
Each feature found is kept and registered in S1, restricted, or switched off while S4 checks the vendor's terms.
A flavour of the worked example
| Tool and AI feature | Collaboration suite: meeting recap |
|---|---|
| What it does | Summarises meetings and lists actions |
| On by default? | Yes |
| Data it can reach | Meeting audio, chat, shared files |
| Decision | Keep and register |
A few fields from one record of the toolkit's worked example, with long text shortened.
Next step
Guided build coming next.
Request access
Ask for access to the guided builds, including this kit's when it is ready.