You can’t govern AI you can’t see

The visibility gap AI enters an organization through more than procurement: a browser assistant, an AI feature switched on in an existing product, or a team’s experiment with customer documents. A vendor list will not tell you which decisions those systems influence, where the data goes, or who owns the risk. NIST’s voluntary AI Risk Management Framework and its Generative AI Profile treat risk as a lifecycle concern. Knowing the deployment context and the people affected matters as much as knowing the model’s name. An inventory is a starting point, not proof that a system is safe. Risk example — illustrative, not a reported incident A support team uses an unreviewed AI tool to summarize customer tickets. The approved-tool register shows no such use. Nobody has checked whether personal data is retained, which account controls access, or whether the summaries feed customer-facing decisions. The visibility gap becomes a privacy and accountability gap before anyone notices a bad answer. CTO actions • Map actual use: approved tools, embedded AI features, pilots and personal-account use. Invite disclosure without blame; reconcile it with procurement and identity records. • Record a business owner, purpose, data categories, provider, access permissions and review status for each use case. • Prioritize systems touching sensitive information or consequential decisions. Close unknown data flows before expanding them. • Give teams a clear approval path. Reconcile the register regularly and whenever a use case changes; assign owners to unresolved gaps. The 10pm question If you asked where AI touches customer data tonight, would you get evidence — or a list of products you bought? Governance brief based on NIST guidance, not a report of a new incident. The actions above are practical recommendations, not a claim of NIST certification or a legal compliance checklist.