Assessing Shadow AI: an illustrative 90-day containment plan

Unsanctioned AI can enter an organization through a side tab, a personal account, or an API key wired into a script. Unlike an approved tool with a procurement trail, those uses may lack a named owner or decision records. An assessment needs to establish what the available sources reveal and what remains unknown; the presence of a blind spot alone does not determine an audit outcome.

The IBM study, conducted by Ponemon Institute, covered breaches experienced from March 2024 through February 2025. These findings describe that sample, rather than the prevalence of breaches across all organizations.

An approved alternative is one option to evaluate. In its November 2023 Gauss announcement, Samsung described internal employee use for tasks including email, document summaries and coding, alongside security and privacy review. That provides a concrete example of planned tool access, without establishing which approach will fit another organization.

The model was never the problem. You can't see the use — and what you can't see, you can't govern, log, or prove when someone asks for it. Survey findings need their population and scope; they do not establish usage in your workforce. Banning it just pushes the use one tab deeper into the dark; a trail is what works. Here is an illustrative 90-day planning sequence: find it, fence it, formalize it. It is a sequencing guide, not a delivery commitment. Timing and coverage depend on source availability, authorized access, integrations, and the team's capacity to assess and implement controls.

Days 1–30: Find it

You can't contain what you haven't named. The first month is pure discovery, and the goal is an honest inventory — not a witch hunt. The moment people think the survey is about blame, the real usage goes quiet and you've made the problem harder to see.

The first phase aims for an inventory linked to the sources reviewed, with owners, unresolved questions, and coverage limits recorded. Logs and surveys cannot establish every AI use, and an inventory alone does not establish audit readiness.

Days 31–60: Fence it

Now you put up fences. Not the final policy — provisional guardrails that convert invisible use into visible, logged use while you design the permanent version. This is the gap that bites: among the organizations that were breached through their AI, 97% lacked proper AI access controls (IBM, 2025). The exposure isn't exotic; it's the absence of the basics.

The second phase considers four controls, in this order. First, stand up an allowlist: the sanctioned tools get real accounts with logging and SSO, so use becomes attributable — and plan the approved alternative alongside the restrictions, subject to procurement, integration, and testing. Assess whether the approved option supports the tasks people need to complete. Second, write a data-loss rule for the classes that matter most — customer PII, financials, anything regulated — to reduce unintended disclosure and test what the control covers. Third, require a human-in-the-loop checkpoint for any decision with legal or financial consequence; the model can draft, but a named person signs. Fourth, retire the tools with no path to compliance — and say so out loud, because a clear "no" is itself a control.

You're not chasing perfection here. The goal is to bring identified uses into an approved, logged workflow and record the remaining coverage gaps.

Days 61–90: Formalize it

The last month makes it stick. A fence you rebuild every quarter is just a chore; governance is the version that survives staff turnover and a re-org. Formalizing means three durable things: a written policy people can actually follow, a named owner for each sanctioned tool (a person, not a team), and a tamper-evident audit trail that records input, model, version, and the human who approved each consequential use.

Policy and implemented controls both need review. 63% of breached organizations had no AI governance policy, or were still "developing" one (IBM, 2025). That finding supports assessing the controls in operation; a policy's status alone does not determine an inspection outcome.

Where most shadow-AI advice stops

Almost every shadow-AI playbook treats this as a security problem: detect the tools, block the risky ones, move on. That's necessary and it isn't enough — detection-and-blocking pushes the use onto a phone you can't see, trading a visible risk for an invisible one, and it never produces the thing an inspection asks for: evidence.

The proposed sequence works backwards from a reviewer's question — establish who used what, on which data, and who approved it — instead of forwards from the firewall. That reorders everything. Find opens with amnesty, not enforcement, because enforcement-first drives use underground and you lose the inventory. Fence pairs restrictions with a sanctioned, logged alternative where feasible, with timing agreed for the environment. Formalize means a tamper-evident trail that lets you replay one decision months later — not a policy PDF nobody opens. Detection can indicate observed use; evidence and human review help assess the controls. Neither guarantees a complete inventory or a passed inspection.

The pushback you'll hear — and the answer

"This will kill productivity." Backwards — productivity is why the shadow AI is there. In Wolters Kluwer's breakdown of a December 2025 healthcare survey, 45% of providers who had used unapproved AI cited faster workflows as their primary reason; 24% cited better functionality than approved tools. The full survey included 518 providers and administrators. Wolters Kluwer sells clinical AI, and this subgroup finding does not establish usage in your organization. Take away the tool with no governed substitute and you don't get safety; you get the same demand, now invisible. Give people a sanctioned option that's genuinely better, and it flows to where you can see it.

"Just ban it — we already have a policy." A policy nobody enforces is theatre, and "we're still developing one" describes a large share of the companies that just got breached (IBM, 2025). Prohibition doesn't remove the demand; it just hides it. The ban-only approach does not by itself establish that the controls work.

"Isn't inventorying everyone's AI just surveillance?" It's the opposite, and it has to be. You're not building a list of who to punish — you're building the register that lets people keep the tools that help, safely. Frame it as policing and the usage goes quiet; frame it as permission and it comes into the light. That's why the first pass runs on amnesty.

Why 90 days, and why now

The service timeline is illustrative; regulatory dates depend on the system and the organization's role. As of 18 October 2026, the Commission's implementation timeline distinguishes these stages:

• Transparency (Article 50): applicable since 2 August 2026. Certain providers of systems already on the market before that date have until 2 December 2026 for the Article 50(2) marking and detection duties. This limited transition does not postpone all transparency duties.
• High-risk AI: following the AI Omnibus's entry into force on 27 July 2026, Annex III rules apply from 2 December 2027; rules for high-risk AI embedded in regulated products covered by Annex I apply from 2 August 2028.

Use the applicable duties to define the scope and responsible reviewers. A containment roadmap does not establish compliance or replace the other requirements relevant to the organization.

Shadow AI is the part of your estate with no evidence layer at all. That's why it is a candidate for a scoped assessment. The illustrative sequence aims to produce an inventory, controls, and reviewable records within the agreed coverage. Actual delivery time depends on access, evidence, and implementation requirements; it does not establish that every use has been found or that an inspection will be passed.

FAQ

Shadow AI is the audit question arriving early: can you prove who used what, on which data, and who signed off? If you can't replay that for one real decision today, that's where the 90 days start — with the trail, not the model. The playbook on AI adoption and audit preparation is the longer version of the same fight; shadow AI is only where the trail goes dark first.

For possible project deliverables and review criteria, see our AI governance service scope.