# Assessing Shadow AI: an illustrative 90-day containment plan

> What to find, what to fence off, and what to formalize — before unsanctioned AI shows up as an audit finding.

**Author:** André Queiroz (dezotech) · **Published:** 2026-06-01
**Source:** https://dezotech.com/en/insights/shadow-ai-90-day-containment-plan

---

Unsanctioned AI can enter an organization through a side tab, a personal
account, or an API key wired into a script. Unlike an approved tool with a
procurement trail, those uses may lack a named owner or decision records.
An assessment needs to establish what the available sources reveal and what
remains unknown; the presence of a blind spot alone does not determine an audit
outcome.

<PullStat value="1 in 5" caption="of the 600 breached organizations in IBM's 2025 study reported a breach due to shadow AI. High shadow-AI use was associated with USD 670,000 higher average breach costs than low or no use." />

The [IBM study](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls), conducted by Ponemon Institute, covered breaches
experienced from March 2024 through February 2025. These findings describe that
sample, rather than the prevalence of breaches across all organizations.

An approved alternative is one option to evaluate. In its
[November 2023 Gauss announcement](https://news.samsung.com/global/samsung-ai-forum-2023-day-2-discussing-technological-trends-and-the-future-of-generative-ai), Samsung described internal
employee use for tasks including email, document summaries and coding, alongside
security and privacy review. That provides a concrete example of planned tool
access, without establishing which approach will fit another organization.

The model was never the problem. You can't see the use — and what you can't see,
you can't govern, log, or prove when someone asks for it. Survey findings need
their population and scope; they do not establish usage in your workforce.
Banning it just pushes the use one tab deeper into the dark; a trail is what works.
Here is an illustrative 90-day planning sequence: find it, fence it, formalize
it. It is a sequencing guide, not a delivery commitment. Timing and coverage
depend on source availability, authorized access, integrations, and the team's
capacity to assess and implement controls.

## Days 1–30: Find it

You can't contain what you haven't named. The first month is pure discovery, and
the goal is an honest inventory — not a witch hunt. The moment people think the
survey is about blame, the real usage goes quiet and you've made the problem
harder to see.

<Checklist heading="Days 1–30 — Find it" items={[
  'Pull egress and proxy logs for traffic to known AI providers — not just the obvious chatbot.',
  'Run a no-blame survey of every team — amnesty surfaces more than enforcement on the first pass.',
  'Flag the high-consequence uses first: anything touching customer PII, credit, or a regulated decision.',
  'Assume exposure until proven otherwise — 65% of shadow-AI breaches hit customer PII (IBM, 2025).',
  'Record every tool in one register a named human owns — not a wiki nobody reads.'
]} />

The first phase aims for an inventory linked to the sources reviewed, with
owners, unresolved questions, and coverage limits recorded. Logs and surveys
cannot establish every AI use, and an inventory alone does not establish audit
readiness.

<InlineCTA href="/en/contact" cta="Discuss a scoped discovery assessment" heading="What could your available sources reveal?">
Describe one team, its workflow, and the sources available for authorized review.
We can assess a diagnostic scope and its dependencies. Finding particular uses,
completing an inventory, and assessing controls depend on the evidence available;
there is no fixed discovery time or guaranteed inspection outcome.
</InlineCTA>

## Days 31–60: Fence it

Now you put up fences. Not the final policy — provisional guardrails that convert
invisible use into visible, logged use while you design the permanent version.
This is the gap that bites: among the organizations that were breached *through
their AI*, **97% lacked proper AI access controls** (IBM, 2025). The exposure
isn't exotic; it's the absence of the basics.

The second phase considers four controls, in this order. First, stand up an allowlist: the
sanctioned tools get real accounts with logging and SSO, so use becomes
attributable — and plan the approved alternative alongside the restrictions,
subject to procurement, integration, and testing. Assess whether the approved
option supports the tasks people need to complete. Second, write a data-loss rule
for the classes that matter most —
customer PII, financials, anything regulated — to reduce unintended disclosure
and test what the control covers. Third, require a human-in-the-loop checkpoint for any decision with
legal or financial consequence; the model can draft, but a named person signs.
Fourth, retire the tools with no path to compliance — and say so out loud, because
a clear "no" is itself a control.

You're not chasing perfection here. The goal is to bring identified uses into
an approved, logged workflow and record the remaining coverage gaps.

## Days 61–90: Formalize it

The last month makes it stick. A fence you rebuild every quarter is just a chore;
governance is the version that survives staff turnover and a re-org. Formalizing
means three durable things: a written
policy people can actually follow, a named owner for each sanctioned tool (a
person, not a team), and a [tamper-evident audit trail](/en/insights/ai-audit-trail-capture-seal-replay) that
records input, model, version, and the human who approved each consequential use.

<Callout heading="Find → Fence → Formalize">
The proposed sequence: identify uses within the available sources, assess
controls for consequential tasks, then define policy, owners, and records that
support human review. Ninety days is an illustration; the project timeline and
coverage need their own assessment.
</Callout>

Policy and implemented controls both need review. **63% of breached organizations
had no AI governance policy, or were still "developing" one** (IBM, 2025).
That finding supports assessing the controls in operation; a policy's status
alone does not determine an inspection outcome.

## Where most shadow-AI advice stops

Almost every shadow-AI playbook treats this as a security problem: detect the
tools, block the risky ones, move on. That's necessary and it isn't enough —
detection-and-blocking pushes the use onto a phone you can't see, trading a
visible risk for an invisible one, and it never produces the thing an inspection
asks for: evidence.

The proposed sequence works *backwards* from a reviewer's question — establish who used
what, on which data, and who approved it — instead of forwards from the firewall.
That reorders everything. Find opens with amnesty, not enforcement, because
enforcement-first drives use underground and you lose the inventory. Fence pairs
restrictions with a sanctioned, logged alternative where feasible, with timing
agreed for the environment. Formalize means a tamper-evident trail that
lets you replay one decision months later — not a policy PDF nobody opens.
Detection can indicate observed use; evidence and human review help assess the
controls. Neither guarantees a complete inventory or a passed inspection.

## The pushback you'll hear — and the answer

**"This will kill productivity."** Backwards — productivity is *why* the shadow AI is
there. In [Wolters Kluwer's breakdown of a December 2025 healthcare survey](https://www.wolterskluwer.com/en/expert-insights/shadow-ai-providers-are-using-unapproved-tools-to-improve-workflow),
45% of providers who had used unapproved AI cited faster workflows as their primary
reason; 24% cited better functionality than approved tools. The full survey
included 518 providers and administrators. Wolters Kluwer sells clinical AI,
and this subgroup finding does not establish usage in your organization. Take away the tool with no governed
substitute and you don't get safety; you get the same demand, now invisible. Give
people a sanctioned option that's genuinely better, and it flows to where you can see
it.

**"Just ban it — we already have a policy."** A policy nobody enforces is theatre, and
"we're still developing one" describes a large share of the companies that just got
breached (IBM, 2025). Prohibition doesn't remove the demand; it just hides it. The
ban-only approach does not by itself establish that the controls work.

**"Isn't inventorying everyone's AI just surveillance?"** It's the opposite, and it
has to be. You're not building a list of who to punish — you're building the register
that lets people keep the tools that help, safely. Frame it as policing and the usage
goes quiet; frame it as permission and it comes into the light. That's why the first
pass runs on amnesty.

## Why 90 days, and why now

The service timeline is illustrative; regulatory dates depend on the system
and the organization's role. As of **18 October 2026**, the Commission's
[implementation timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline)
distinguishes these stages:

- **Transparency (Article 50):** applicable since **2 August 2026**. Certain
  providers of systems already on the market before that date have until
  **2 December 2026** for the Article 50(2) marking and detection duties. This
  limited transition does not postpone all transparency duties.
- **High-risk AI:** following the [AI Omnibus's entry into force on 27 July 2026](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force),
  Annex III rules apply from **2 December 2027**; rules for high-risk AI embedded
  in regulated products covered by Annex I apply from **2 August 2028**.

Use the applicable duties to define the scope and responsible reviewers.
A containment roadmap does not establish compliance or replace the other
requirements relevant to the organization.

Shadow AI is the part of your estate with no evidence layer at all. That's why
it is a candidate for a scoped assessment. The illustrative sequence aims to
produce an inventory, controls, and reviewable records within the agreed
coverage. Actual delivery time depends on access, evidence, and implementation
requirements; it does not establish that every use has been found or that an
inspection will be passed.

## FAQ

<FAQ items={[
  {
    q: 'What actually counts as shadow AI?',
    a: "Any AI tool or model used for work without approval or oversight — from a public chatbot in a browser tab to an unsanctioned API key wired into a script. If nobody approved it and nothing logs it, it's shadow AI."
  },
  {
    q: "Where do I start if there's no budget for this?",
    a: 'Start by assessing authorized access to the logs you already retain. Compatible egress and proxy data may show traffic to known AI providers, while a no-blame survey can add context. Coverage and effort depend on the available sources; neither method proves every AI use. In the 2025 IBM sample, organizations with high shadow-AI use had average breach costs about USD 670,000 above those with low or no use.'
  },
  {
    q: 'How do I even find it if it is hidden?',
    a: 'Assess compatible egress and proxy logs for observed traffic to known AI providers, with authorized access, then use a no-blame survey to add context. Record the sources reviewed and unresolved gaps, and prioritize identified uses touching customer PII or a regulated decision. Discovery timing and coverage depend on the agreed scope; it does not guarantee an inspection outcome.'
  }
]} />

Shadow AI is the audit question arriving early: can you prove who used what, on
which data, and who signed off? If you can't replay that for one real decision
today, that's where the 90 days start — with the trail, not the model. [The
playbook on AI adoption and audit preparation](/en/insights/adopt-ai-without-failing-your-next-audit)
is the longer version of the same fight; shadow AI is only where the trail goes
dark first.

For possible project deliverables and review criteria, see our
[AI governance service scope](/en/governance).