Find the use cases that existing records miss.
Shadow AI describes AI use outside an organisation's approved inventory or review process. It can include a personal account used for work, a newly enabled AI feature or a supplier capability introduced without a fresh review. The term does not decide whether a use is legally prohibited or high-risk.
Begin with authorised sources: staff declarations, procurement records, application owners and supplier information. Agree any additional discovery methods with the people responsible for privacy, security and employee relations. State what the chosen sources can and cannot reveal.
Turn a discovery into a useful record.
An unexplained tool name does not tell a reviewer what happens in the business. Ask which task it supports, who uses it, what information enters it and how the output affects a decision. Identify the account or service arrangement without collecting passwords, unnecessary prompt contents or personal files.
Give the record an owner and a clear next action. Some findings need supplier information; others need a policy clarification, an approved alternative or an immediate restriction while the concern is reviewed.
Make the next step proportionate to the use.
Prioritise cases involving sensitive information, consequential decisions or unclear supplier arrangements. Distinguish an internal drafting experiment from an automated process affecting customers or employees. Review legal scope and system classification through the relevant assessment route; do not use the fact that a tool was unapproved as the classification itself.
- Confirm the purpose, users and information involved.
- Identify the supplier and relevant service terms.
- Assign privacy, security or specialist review where needed.
- Record approval conditions, restrictions or the reason use must stop.
Agree applications and delivery around your environment.
An EUAIC engagement can be scoped around intake forms, an AI register, review routes, evidence requests and management reporting. The practical deliverables should identify the initial coverage, unresolved findings and owners responsible for bringing each use case into the agreed process.
Automated discovery, integrations and technical enforcement require a separately agreed specification. We do not assume permission to monitor employee activity or promise visibility of every AI tool. A clear coverage statement is more useful than an unsupported claim of complete detection.
Make approved adoption easier to maintain.
Give people a simple route to declare a new use, understand what is allowed and request a review. Connect accepted use cases to supplier changes, policy updates and periodic checks so approval remains meaningful over time.
A useful first discussion starts with your current application list, known AI use, the departments involved and the information you need for decisions. From there, we can define a bounded starting scope and what a successful handover should include.