Module 125 minutes
Why Shadow AI Happens
And why bans rarely work
The question: Why are people using AI we did not approve, and what does that tell us?
You keep: Shadow AI diagnosis
Specialist programmeThe AI Inventory and Shadow AI Lab
Find every use of AI, including the ones nobody approved. Put it on one page. Keep it current.
- 6 modules
- About 2 hours 45 minutes
- 6 artefacts you keep
- 30-day plan
Who it is for
Written for the people asked to produce the list
Risk, compliance, IT, security, internal audit and operations leads, and the AI or data governance owners who must answer the regulator's or auditor's first question.
The problem
Policies ban unapproved tools and people use them anyway. The inventory is a spreadsheet nobody updates, built from procurement records that miss most of the real use.
You leave with an inventory you can defend, and a way to keep it true.
Outcomes
By the end, you can answer
- Why are people using AI we did not approve, and what does that tell us?
- How do we find the AI use that nobody has told us about?
- What goes on the page, and how much is enough?
- What do we decide for each use, and how quickly?
- How do we make the approved route faster than the shadow one?
- How do we keep the inventory accurate next quarter and next year?
Outline
Six modules. Each ends with something you keep.
Every module answers one question. The artefact is completed before you move on.
Module 230 minutes
Find It
Four ways to discover AI use, and what each misses
The question: How do we find the AI use that nobody has told us about?
You keep: Discovery plan
Module 330 minutes
The One-Page Inventory
One row per use, six columns, honest gaps
The question: What goes on the page, and how much is enough?
You keep: One-page AI inventory
Module 430 minutes
Triage Every Use
Allow, allow with conditions, replace or stop
The question: What do we decide for each use, and how quickly?
You keep: Triage decision sheet
Module 525 minutes
Build the Paved Road
Make the safe way the easy way
The question: How do we make the approved route faster than the shadow one?
You keep: Paved road catalogue
Module 625 minutes
Keep It True
Review cycle, intake and evidence
The question: How do we keep the inventory accurate next quarter and next year?
You keep: Review cycle and committee report
CapstoneThen a 30-day plan
Your 30 day plan
- Week 1. Announce a no blame AI amnesty and run the three question survey.
- Week 2. Pull the network, expense and software feature data and merge it into the inventory.
- Week 3. Triage every use: allow, allow with conditions, replace, or stop. Name owners.
- Week 4. Publish the paved road catalogue and book the first quarterly review.
What you produce
Six artefacts, one binder.
- Module 1Shadow AI diagnosis
- Module 2Discovery plan
- Module 3One-page AI inventory
- Module 4Triage decision sheet
- Module 5Paved road catalogue
- Module 6Review cycle and committee report