Most AI governance programmes can't answer the first question: how many AI systems are running?

Every enterprise AI inventory starts as a spreadsheet. Most stop there. Four reasons the spreadsheet doesn't hold:

• It goes stale within weeks. The AI estate changes faster than anyone can manually update it - new vendor signs, new feature releases, new internal experiments. By the next audit, the spreadsheet reflects three months ago.

  
  

• It misses Shadow AI by design. Manual disclosure only surfaces what people remember (or want) to disclose. Discovery has to come from multiple signals - procurement records, SaaS telemetry, browser signals, network traffic - to be comprehensive.

  
  

• It can't carry evidence. Auditors don't accept "trust the spreadsheet"; they ask for the decisions, reviewers, artifacts, and timestamps that prove the inventory is accurate. Spreadsheets store names; they don't store proof.

  
  

• It doesn't connect to anything else. Risk assessment, framework mapping, vendor reviews, intake - every other governance workflow needs to read from the inventory. A spreadsheet that lives in someone's Drive doesn't.