Find unapproved AI use, review data boundaries and give staff a practical approved route for the work they need to do.
Shadow AI means AI use that the organisation has not approved or cannot see. It can include personal accounts, separately purchased tools and features introduced inside existing software. The discovery work should help people explain what they need, as well as identify exposure.
Start with tools and tasks
Ask teams what they use, why they use it and what information they put into it. Compare those answers with approved software and available administrative records. Collect only the information needed for the review, with appropriate transparency and privacy checks.
Include AI features in existing platforms. Approval of a software product does not necessarily mean every new feature or data flow has been reviewed. Check the plan, settings and contractual terms actually in use; avoid assuming all consumer or business accounts behave identically.
Agree the response for each use
If sensitive information has been entered into an unapproved tool, involve the responsible privacy and security people to assess the facts. Do not assume every incident is a reportable breach or that a business subscription resolves every confidentiality issue.
Some uses should stop. Others may be supported through an approved tool, different data inputs or clearer review requirements. Explain the permitted route and who can answer questions. Training and guidance should address the tasks staff actually perform.
Keep the inventory useful
Record the tool, intended use, owner and data boundaries. Review changes in access, features and terms. An inventory helps teams make decisions and gives governance owners a place to track unresolved questions.
There is no universal rate of shadow AI use or guaranteed reduction after a policy change. Measure the starting position and the results in your own organisation. This guidance is not a report of a quantified Acuity audit cohort.
For help with an assessment, talk to us. See AI Register, an Acuity resource, for public guidance on maintaining an AI inventory.