Scoping · AI exposure
Most organisations can name two of their AI surfaces.
Staff chat tools, copilots, vendors who switched AI on, agents with credentials. Account for what you can see first — "don't know" is a useful answer.
Step 1 of 7 · Where AI is
Staff using ChatGPT / Claude / Gemini
Microsoft / Google copilots
AI inside tools you already buy
AI coding assistants
Your apps calling AI APIs
Agents with access to systems
AI over your documents (RAG)
AI in your own product
“Don't know” is a useful answer: most organisations can account for two or three of these.
Estimates are indicative, not quotes. Compliance mapping is not legal advice; CISO Marketplace is not a CPA firm and does not perform SOC examinations.