Shadow AI Discovery & Risk Report

Shadow AI Discovery — Find Every AI Tool Your Team Uses

Shadow AI is shadow IT on steroids. Employees paste customer data into ChatGPT, upload financial reports to Claude, use Midjourney with proprietary assets, and connect AI tools to company email via OAuth — often with good intentions but no governance. This assessment finds them all.

• AI Tool Discovery: Identify all AI tools in use across your organisation — browser extensions, mobile apps, desktop tools, API integrations, OAuth connections
• Data Flow Mapping: What company data is being sent to which AI services — PII, financial data, IP, customer information, source code
• Risk Classification: Each discovered AI tool classified by data sensitivity, regulatory exposure, and organisational risk
• EU AI Act Impact: Which discovered tools are high-risk under Annex III — recruitment, credit scoring, medical, and other regulated contexts
• GDPR Data Transfer Assessment: Where is AI-processed data stored? International transfer implications for each tool
• Employee AI Usage Survey: Structured questionnaire to identify AI tools that technical discovery cannot find — personal accounts, mobile-only tools
• AI Acceptable Use Policy: Based on discovery findings — what is permitted, what is prohibited, what requires approval
• Governance Recommendations: Approve, restrict, or block — decision framework for each discovered tool with implementation guidance

⚠️ Legal disclaimer (COMPLIANCE): This product is provided for information and compliance documentation only; it is not regulatory advice. Read the full disclaimer below or in our Terms of Service before purchase.

NIS2 + EU AI Act Article 23 Incident Reporting (Shadow AI Lens)

Unsanctioned ("shadow") AI tool use creates a class of incident that can trigger reporting obligations under both NIS2 Article 23 and the EU AI Act post-market monitoring regime. The discovery pack covers the reporting dimension:

• Shadow AI data exfiltration incident classification — when staff feeding confidential data into unsanctioned AI tools becomes a reportable NIS2 cyber incident or AI Act serious incident
• 24-hour early warning trigger — guidance on when shadow AI incidents (sensitive data fed to consumer AI, prompt injection of business-critical agent) trigger the 24-hour early warning
• 72-hour formal notification template — pre-filled template for shadow AI-originated incidents, including AI tool identification, data category, and remediation
• EU AI Act Article 73 serious incident reporting overlap — for high-risk AI systems, additional reporting obligations under AI Act Article 73 (15-day window for serious incidents); guide covers single-intake workflow
• One-month follow-up reporting — Article 23(4) one-month follow-up report template adapted to shadow AI incident class

Cyber Essentials 2026 Coverage (Shadow AI Lens)

Unsanctioned AI tools create CE 2026 control gaps because the organisation cannot apply the five controls to systems it does not know about. The discovery pack maps shadow AI risk to CE 2026:

• Firewalls — Detection of shadow AI traffic crossing the network boundary (DNS analysis, perimeter logs)
• Secure configuration — Shadow AI tools cannot meet secure configuration baselines because they're not in your CIS-benchmark scope; hardening report identifies uncovered tools
• User access control + MFA mandate — Shadow AI accounts often bypass corporate MFA (CE 2026 mandate 28 April 2026); discovery report flags AI accounts without MFA-via-SSO enrollment; least-privilege review
• Malware protection — Shadow AI browser extensions and desktop tools fall outside endpoint protection / EDR scope; discovery report flags uncovered surfaces
• Security update management — Shadow AI tools miss organisational patch management cycles; vulnerability management gap report