How Much Shadow AI
Is Running in Your Organisation?

Are you aware of AI tools being used in your organisation that have not been reviewed or approved through any formal process?

If you asked each department head today which AI tools their team uses, how confident are you that you would get an accurate and complete answer?

To the best of your knowledge, have employees entered confidential business information — such as client data, internal financials, or unreleased strategy — into a public AI tool (e.g. free-tier ChatGPT, Gemini, or similar)?

Which best describes how AI tools are being adopted by your employees right now?

How frequently do AI outputs — from any tool, approved or not — directly influence client-facing work, financial decisions, or operational processes at your organisation?

Does your organisation have a written policy that defines which AI tools are approved, what data employees may not input, and the consequences of non-compliance?

Is there a named list of AI tools that are formally approved for use — with a defined process for evaluating and adding new tools?

Is there a specific named person or team accountable for AI governance — including policy decisions, tool approvals, and responding to AI-related incidents?

Have employees received active communication — beyond a one-time all-hands or memo — explaining what AI tools they can use, what data they cannot input, and who to contact if unsure?

If an employee reported that confidential data had been entered into an unapproved AI tool — right now, today — does your organisation have a defined response process to contain and assess the situation?