The situation
A professional services firm, 1,400 staff across nine offices, doing audit, tax and advisory work. A twelve-month review of card spend turned up 41 distinct AI tools across roughly 1,900 expense lines, totalling about AUD$140,000 a year, none of it in the IT budget. Six of the tools appear in claims from more than twenty people each and carry most of the AUD$140,000, at more than AUD$50 a seat a month. The remaining 35 are one or two seats and mostly cheaper than that.
Asking around establishes that at least nine hold client data: meeting transcripts, draft advice, extracts from client ledgers. Three are connected into firm systems, two through a mailbox integration and the third through a browser extension with read access to every page a fee earner opens. The firm has one sanctioned tool, an internal assistant built on Amazon Bedrock and used by about forty people in a single practice group.
Eight months ago the COO emailed a ban on AI tools until further notice. Twenty-four of the 41 subscriptions started after that email. Vendor onboarding takes about eleven weeks, and the partnership will not run it for a AUD$20-a-month seat licence. Whatever replaces the ban has to be readable outside IT and has to produce an inventory the firm can show a regulator.
What actually matters
The register is accurate only when someone who has just found a useful tool says so rather than putting it on a card. Eight months of the strictest control available on paper produced a register of zero tools and an estate of 41. Measure the gap between what the register lists and what the card statement shows the firm paying for: a control over an inventory naming none of the 41 protects nothing.
For the 41 bought on personal cards there is no contract at all: no data-processing terms, no retention or deletion commitment, no breach notification, no indemnity, and nobody at the vendor who has heard of the firm. The firm keeps the client obligation and the professional-body exposure while a vendor it never signed with holds the file, and no internal policy retrieves a client document once it has been used for training. The sanctioned Bedrock assistant sits inside an agreement the firm’s general counsel has read. The other 41 sit inside consumer terms clicked through at sign-up.
A diagram generator that never receives an upload and a transcription service holding recordings of audit interviews are not the same risk, so review depth follows what a tool touches rather than what it costs. Run both through the same eleven-week assessment and neither goes through it: when the sanctioned route takes eleven weeks and the card takes two minutes, people use the card. Turnaround is a design parameter.
An approval is a statement about one vendor at one moment: its retention window, its subprocessor list, whether customer content trains the next model, whether the enterprise tier carrying those commitments is still the tier the firm is on. All of those change without announcement, so an entry with no re-review date is a claim the firm cannot support a year later. Blocks decay the same way.
What we’ll filter on
- Disclosure. Does the design make a member of staff more likely to declare a tool they are already using, or less?
- Readable criteria. Can a requester read, before asking, what would get their tool approved and what would get it blocked?
- A named owner and a stated turnaround per state. Is there one person accountable for each state, and a published number of days a requester can plan around?
- Expiry. Do approvals and blocks carry a re-review date, so neither stands unexamined for years?
- Resolution for the 41 already running. Does the design have a route for tools in use today, including ones holding client material, rather than starting from an empty catalogue?
The landscape
Reissuing the ban with enforcement behind it blocks merchant categories on corporate cards, refuses reimbursement and filters vendor domains. Consumption moves onto personal devices and personal accounts, and the firm loses the people still willing to say what they use.
Discovery only pulls card spend, SaaS management data and sign-in logs and publishes the list. It finds what passed through a system the firm can query, so a seat paid for privately and never claimed stays invisible. It also decides nothing, so the nine tools holding client files stay where they are.
Routing everything through the existing vendor-onboarding queue has real criteria and real owners. Eleven weeks for a AUD$20 seat makes it a thing to avoid, and uniform process over non-uniform risk pushes the small end of the estate underground.
A closed allow-list publishes approved tools and forbids everything else, with no route from outside the list to inside it. A need it does not cover goes on a card, and the gap between list and work widens unnoticed.
A published three-state classification names each tool approved, blocked or under evaluation, publishes the criteria separating the three and defines the route between them. Under evaluation gives a request somewhere legitimate to sit while a decision is being made, which turns “I need this today” into a register entry rather than a card transaction.
AWS Marketplace Private Marketplace is the AWS mechanism closest to a curated catalogue. An administrator builds an experience, a curated catalogue of approved products with custom branding that controls what users in the organisation can procure, and associates it with an audience: the whole organisation, an organisational unit, or an individual account. Experiences flow down the AWS Organizations hierarchy and the live experience closest to an account governs it. Products are approved or declined per experience. Product procurement requests are on by default, so a user who reaches a product outside their experience sees a banner with a Request product button. Administrators and requesters both receive events when a request is raised, approved or declined, and those events can be routed to email.
AWS Marketplace Vendor Insights publishes a security profile for a participating SaaS product across ten control categories, drawn from three sources. The seller completes a self-assessment, and can upload others, including the Vendor Insights security self-assessment and a CAIQ response. The seller’s ISO 27001 and SOC 2 Type II audit reports are mapped onto the same control categories. Live evidence comes from the seller’s own production accounts for 25 of the controls, so that part reflects current configuration rather than a signed questionnaire’s date.
Together they are an allow-list with a request path over the estate that flows through AWS procurement. None of the 41 flows through it: Private Marketplace governs what can be bought through AWS Marketplace, not a browser extension on a personal card.
The register’s framing comes from the governance vocabulary the platform side already uses and from the AWS Cloud Adoption Framework. AWS CAF groups its capabilities into six perspectives, one of them Governance, and one of that perspective’s seven capabilities is application portfolio management: managing and optimising the application portfolio in support of business strategy. AWS puts an accurate and complete application inventory under it, and names minimising application sprawl and facilitating application lifecycle planning as what the capability delivers. Forty-one undeclared subscriptions is application sprawl with a worse data story.
Evaluation
Side by side
| Approach | Disclosure | Readable criteria | Owner and turnaround | Expiry | Resolves the 41 |
|---|---|---|---|---|---|
| Reissued ban with enforcement | ✗ | ✗ | ✗ | ✗ | ✗ |
| Discovery only | ✗ | ✗ | ✗ | ✗ | ✗ |
| Vendor-onboarding queue as the only route | ✗ | ✓ | ✓ | ✗ | ✗ |
| Closed allow-list | ✗ | ✗ | ✗ | ✗ | ✗ |
| Private Marketplace experience alone | ✗ | ✗ | ✗ | ✗ | ✗ |
| Three-state register with a fast lane | ✓ | ✓ | ✓ | ✓ | ✓ |
One row scores on disclosure and resolution, the two the firm is failing at today. The vendor-onboarding queue is the only alternative scoring on owner and turnaround: eleven weeks is at least a number a requester can plan around. A Private Marketplace request has a named administrator, since administration sits with the management account or a delegated administrator for the service, but no clock, and nothing in the mechanism escalates a request that sits. Both lose on disclosure: neither reaches spending that never touched them. Discovery misses it too. Detection is not disclosure: it names what the firm already paid for through a system it can query, and gives nobody a reason to come forward with the next one. The closed allow-list publishes answers without the criteria behind them, so a requester cannot tell whether their tool would pass and does not ask.
Routing a tool into a state
The solution
Publish a three-state register, put a fast lane in front of it, and run an amnesty to load it with the 41.
The entry is the unit of governance, not the tool. Every row carries the tool name, what it is for, the state, the named business owner, the decision date, the re-review date, the data classes permitted, and for a block, the substitute. Approval attaches to a use: one vendor can be approved for internal drafting and blocked for anything carrying a client name.
The criteria are published before anyone asks. Three questions decide the lane: does the tool receive client or personal data; does it connect into firm systems (a mailbox, a file store, a browser extension with page access); is it under AUD$50 a seat on the vendor’s standard terms. A no, no, yes takes the fast lane, two working days with one named reviewer and an explicit no-client-data condition. Anything else takes the standard lane, ten working days with a security and data-protection review and a partner named as business owner before approval.
Under evaluation carries a clock and an escalation. A request past its stated turnaround escalates to a named person and does not auto-block. The queue is capped, so overload surfaces as a resourcing conversation rather than silence.
Not listed is defined, in the first line of the register. An absent tool is treated as under evaluation and needs a request. Leave that unsaid and every reader chooses between “absent means fine” and “absent means forbidden”.
Every block names a substitute or a date. The internal Bedrock assistant covers most of what the transcription and summarisation tools were bought for; where nothing internal fits, the block records the date by which the firm will say what does.
Enforcement goes where the money moves. An AI subscription is reimbursable only against a register entry, and corporate cards get merchant-level rules for the vendors already blocked. For anything procured through AWS, a Private Marketplace experience associated with the organisation root carries the approved products, product procurement requests stay on, and the request events go to the register owner. Setting that experience live blocks new subscriptions, and changes to existing subscriptions, for products the experience has not approved. It does not block usage of subscriptions the firm already holds, so the 41 get resolved through the register rather than by switching a control on. Vendor Insights profiles do part of the standard-lane review for SaaS products that publish one.
Re-review dates are set at approval. Twelve months generally, six where client data is permitted, and immediately on notice that the vendor has changed its terms, its subprocessors, or its position on training against customer content. Blocked entries carry dates too.
What the register costs to run. Running it takes about a fifth of a reviewer’s week on standard-lane assessments, an hour of a partner’s time per approval, and a front-loaded fortnight to clear the amnesty backlog. Fully loaded that is roughly AUD$40,000 a year in reviewer and partner time, or AUD$120,000 over three years. The undeclared card spend over the same three years is AUD$420,000, and nine of those tools hold client material the firm cannot account for.
The register is also the firm’s application inventory. Measure four things monthly: the disclosure gap, median days to decision in each lane, the share of approved entries past re-review, and blocks with no named substitute, the leading indicator of the next round of personal-card purchases.
Worked example
The amnesty runs for thirty days. Declaring a tool during the window carries no consequence, including for the nine already holding client material, and the announcement says so rather than implying it. All 41 are declared, and eleven more arrive that nobody in finance knew about.
A research assistant surfaces from the tax team with three years of client memos uploaded into it, bought by someone who left in March and still billing to a card nobody was reconciling. It goes to under evaluation on day one rather than being blocked on sight, because blocking it would end the firm’s access to the account and the deletion controls inside it. The tax partner becomes the named owner, the review runs the full ten days, and the outcome is a paid enterprise tier with training against customer content disabled and the memos exported and removed.
Six weeks in, the card statement shows three subscriptions with no register entry, against 41 when the review started. Median fast-lane time is under two days, and four requests sit past their turnaround in the standard lane, surfacing the reviewer as the constraint rather than another year of card spend.
What’s worth remembering
- Disclosure before security. Score any design first on whether it makes people more likely to declare what they already run.
- Three states, not two. Approved and blocked alone leave a new tool nowhere legitimate to sit while someone decides.
- Owner, turnaround, expiry on every entry. An approval with no re-review date stops being true without anyone recording that it has.
- Define “not listed”. Say it in the register’s first line, or every reader decides for themselves and the estate rebuilds itself.
- Blocks need a substitute. A block with no named substitute or date for one is a ban, and it produces the same behaviour.
- Private Marketplace governs new buying. Experiences block unapproved new AWS subscriptions, not usage of ones already running; the expense policy catches the personal-card estate.