You cannot govern what you have never counted.
Most AI governance programs start with policy. The durable ones start with an inventory.
Ask a research or clinical organization how many AI tools are in use and the honest answer is usually a range — and the range is usually wrong. Embedded vendor algorithms, departmental purchases, individual accounts on public tools: the portfolio is always larger than the inventory.
Governance built on an undercount inherits the undercount. A policy that binds twelve registered systems does nothing for the fortieth unregistered one — and the unregistered ones concentrate exactly where oversight is weakest: free tiers, personal accounts, tools that arrived inside another product.
Counting is unglamorous, which is why it gets skipped. But an operating governance program we designed and ran across a 180-tool portfolio at a multi-state health system began precisely there: intake, risk tiering, evidence standards, deployment gates, monitoring, escalation, and retirement — in that order. The gates only worked because the intake came first.
Governance built on an undercount inherits the undercount.
The same sequence holds for scientific AI. Before evidence standards, before validation gates, before continuous assurance: an honest census of what is actually running, what decisions each system touches, and who owns each one. Discovery before doctrine.
One stage of trust gets skipped more than any other — the first one. Trust is earned in stages, and the first stage is knowing what you have.