Keep, replace or retire

By now you have a pile: what people disclosed, what the records showed, what vendors switched on, and what your power users built. This lesson turns the pile into a list. Every item gets the same four answers: what kind of thing it is, whether it's shared, what's at stake, and what you'll do with it.

What kind of thing is it?

The AI list records four kinds of item, and the kind changes what you check.

• A tool: an AI tool people use directly. The question is whether it's approved, and on the right account.
• An AI feature a vendor switched on: meeting summaries in the video-call software, drafting inside the CRM. Nobody chose these, which is why they're the easiest to miss.
• A shared item: something someone made that others rely on, like a prompt library, an automation or a template.
• A use: a way of using AI that builds nothing. A recruiter ranking CVs with a chat assistant has made nothing new, but the use still belongs on the list, because the two questions still apply.

Two quick questions

Shared and stakes decide what each item needs. Module 6 goes deeper; for the list, a quick yes or no is enough, and the builder below has the tests built in.

Is it shared? Yes if someone else depends on it, it acts beyond its user's own work, it writes into a shared system or a system of record, or outsiders use it directly with no person in between.

What's at stake? High if it helps decide something about a person, touches regulated or confidential data, acts outside the user's own work without a person checking, speaks or commits for the organisation to outsiders, or could harm someone who never uses it. Otherwise, low.

Anything shared needs an owner. Anything high-stakes needs more care, and personal high-stakes use needs a proven tool and a named check. Personal, low-stakes use needs only approved tools and the output standard.

Keep, replace or retire

In Cisco's 2024 survey, most organisations didn't ban AI. They limited it: which data can go in, and which tools can be used.

That's what the three decisions do, one item at a time.

• Keep it. It stays on the list. If it's a tool that isn't approved yet, keeping it means it goes through the vendor checklist first.
• Replace it. Usually with an approved tool that does the same job. The right tool on the wrong account is the most common find of all. Move people onto the replacement first, then switch the old one off.
• Retire it. Stop it, and deal with three things: its data (export what you need, delete the rest under the vendor's terms), anything that depends on it, and the people who relied on it, who need to know what replaces it and when.

The order matters. Switch something off before there's a replacement and you've recreated a ban in miniature: the use moves to a personal tool and drops out of sight again.

Build the list

Add everything the three sources found. Open each item to answer the two questions and choose a decision. Mark anything the records found that people also disclosed, because that's how the list checks whether the promises are working.

Four mistakes that make a list wrong

• Keeping something because it came free. An AI feature a vendor switched on still sends your data somewhere. It goes through the vendor checklist like anything you'd buy, including whether admins can control it.
• Leaving uses off because nothing was built. Screening CVs with a chat assistant is on the list, and it's high stakes, because it helps decide something about a person.
• Writing people instead of tools. “Who uses it” is a count: about twelve people in sales. A list with names on it is a disclosure log, and the custodian holds those, not the leadership team.
• Retiring before replacing. Every switch-off without somewhere to go teaches people the amnesty was a trap, and the next list will be shorter than the truth.

The pilot kit counts the list three times: on day 0, day 45 and day 90, checking its size against the completeness rule each time. Expect it to grow. As people see the promises kept, more of what they use comes forward.

When is the list complete?

The framework gives the AI list a rule for when it's complete. Three things must be on it: every approved tool, every AI feature a vendor has switched on, and every shared item. And what people disclose must match what monitoring finds.

The panel under the builder tracks all four as you work. Two things it can't do for you. It can't know about software you haven't checked, so the vendor check has to actually happen. And owners, backups and review dates aren't on the list yet. They come in module 7, for everything shared or high-stakes.