The most dangerous line on your AI budget is the one that does not appear on it. Shadow AI, the tools and API keys adopted without central visibility, is where surprising bills and unmanaged risk both come from. Tracking it starts with finding it.
Where shadow AI hides
It hides in individual SaaS subscriptions expensed on personal cards, in AI features quietly switched on inside tools you already pay for, in developer API keys set up for a prototype and never registered, and in enterprise contracts that added AI capabilities during a renewal nobody scrutinized. None of these appear in a formal AI inventory because no inventory was built to capture them.
The discovery pass
Start with a discovery pass across expense reports and card statements, searching for anything AI-related. Cross-reference with your identity provider for AI tool logins, and ask every team lead to list the AI tools their team actually uses. Organizations routinely find two to three times more AI spend than they expected on the first pass.
Bring it into the light
Every tool you find gets an entry in a single inventory: name, vendor, monthly cost, owning team, and whether it touches sensitive data. The goal at this stage is visibility, not enforcement. You cannot govern or track what you have not first located.
Keep it from regrowing
Shadow AI regrows unless there is an easy path to register new tools. Create a lightweight intake, a form or a channel, so adopting a new AI tool means telling someone rather than asking permission. That keeps the inventory current without slowing anyone down, and it turns shadow spend into tracked spend on an ongoing basis.
Shadow AI is not a discipline problem; it is a visibility problem. Find it, inventory it, and give it an easy path to stay visible, and the spend that used to surprise you becomes spend you can actually manage.