Stage 2 · Lesson 2 of 6
Finding shadow AI
is AI that people use without the organisation knowing or approving it: an analyst pasting customer data into a public chatbot, a team wiring an into a script with a personal key, or a browser extension that summarises email.
It is usually well meant and it is everywhere. Finding it combines asking and looking. Ask through a short, non-punishing survey and team interviews.
Look at expense claims and procurement for AI subscriptions, network and proxy logs for traffic to AI services, API keys in code repositories, and browser extension lists. The goal is not to ban everything but to bring use into the light, then offer approved tools with clear rules.
Common trapa ban that pushes use further underground, where you see even less.
A question to check yourself, an AI practice session and 1 cheat sheet entry come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- GuideFreeNIST AI Risk Management Framework (AI RMF)
National Institute of Standards and Technology (NIST) · Intermediate
The Map function is the reasoning behind every inventory entry: context, purpose and who is affected
- GuideFreeEU AI Act: regulatory framework for AI (European Commission)
European Commission · Beginner
Provider, deployer and the risk tiers, the two labels every inventory entry needs