Shadow AI audit sample
Follow the data.
The tool inventory, findings and working documents from a Shadow AI Risk Audit, shown for a sample company. Every company detail and risk rating below is sample data.
A tool inventory with owners.
| Category | Sample use |
|---|---|
| Chat assistant on a personal account | 6 users. Drafting replies. Client contact details pasted. Owner: operations lead. Approval: unapproved. |
| Meeting summary tool | 4 users. Internal meeting notes. Pricing discussions included. Owner: sales lead. Approval: unknown. |
| Coding assistant on a work account | 2 users. Public documentation examples. Owner: technical lead. Approval: approved for public material. |
| Document drafting tool | 3 users. Internal templates. Account terms not recorded. Owner: office lead. Approval: pending review. |
Where the data goes.
| Data type | Destination and boundary |
|---|---|
| Client contact details | Personal-account chat assistant. Leaves the company boundary. No approval recorded. |
| Internal pricing discussion | Meeting summary tool. External processing. Retention terms unknown. |
| Public code examples | Work-account coding assistant. External processing. Approved public-only route. |
| Internal document templates | Document drafting tool. External processing. Owner review pending. |
Risk ranking, highest first.
| Priority | Sample finding |
|---|---|
| 4: High | Client details in a personal-account chat tool. Stop the route while the owner reviews terms and data handling. |
| 3: High | Pricing in meeting summaries with unknown retention. Restrict recording until approved. |
| 2: Medium | Internal templates in a tool with pending terms review. Document the boundary and owner. |
| 1: Lower | Public-only code examples in an approved work account. Keep the restriction and verify use. |
Remediation checklist.
Sample remediation checklist. The business implements changes; the audit documents the decisions and verifies the agreed evidence.
- Operations lead: stop client data entering personal accounts. Verify with a staff walkthrough and a revised approved-tools list.
- Sales lead: pause sensitive meeting summaries. Record approval, retention and deletion terms before reuse.
- Office lead: classify templates and confirm which content may leave the boundary. Keep a reviewed example.
- Technical lead: confirm the public-only coding rule and record the account setting review.
- Business owner: approve the AI policy, brief staff and assign the next review.
AI use policy excerpt.
Sample AI acceptable use policy excerpt.
Use only the tools on the approved list and the account assigned for work. Keep client files, personal information and contract-restricted data out of AI tools unless the data owner has approved that exact route in writing. Use public or synthetic material for drafting while approval is pending. Review AI output before sharing it. Report an accidental disclosure to the business owner so the company can record what happened and decide what to do next.
SSP and action plan language.
Sample SSP and action-plan excerpts. These are drafting aids for the fictional company, not evidence that a real control is implemented.
| Requirement | Sample document entry |
|---|---|
| 03.01.03: Information flow enforcement | SSP: The approved-tools register names permitted data types and destinations. The data owner approves exceptions in writing. Evidence pending: approved register and walkthrough. |
| 03.01.20: Use of external systems | Action plan: Operations lead will document the terms and restrictions for the personal-account chat route. Close only after approval is recorded and the staff walkthrough verifies the restriction. |
| 03.01.22: Publicly accessible content | SSP: Only approved public examples may be used for drafting intended for publication. A reviewer checks the result before release. |
Requirement names: NIST SP 800-171 Rev. 3. Source checked 2026-10-18.