# Shadow AI tool register

Find every AI tool in use, name its owner and data, and decide each one.

## The question: which AI tools hold our data?

A client, auditor, insurer, board or regulator asks whether you use AI. "I would have to check" shows that no register exists.

This register is for whoever owns that answer, such as a solo IT director, CTO, practice administrator or managing partner. For every tool, it records the owner, the data entered and how the vendor treats it. It also records your written decision.

Build it in a spreadsheet. Buy nothing to start.

## Count the tools before you buy a platform

You cannot write an AI policy for tools you have not found. You cannot pick an approved platform before you know what people do with the others. Several vendors will sell a governance product to fix a problem you have not measured.

If your first count finds 14 unapproved tools beside one licensed platform, the policy produced no usable decisions. Find first, decide second and buy last, if at all.

## Your own count is the number that matters

In Microsoft and LinkedIn's 2024 survey of about 31,000 workers in 31 markets, 75% used AI at work. Of those, 78% brought their own AI tools. The figures are self-reported from a vendor's survey and say nothing about your organisation in 2026.

Treat it as a reason to look. Your own count, which you are about to make, is the number that matters.

## Part 1: Six ways to find tools

Run all six, since each finds what the others miss.

| Method | What it finds | What it misses | Effort |
|---|---|---|---|
| Expense reports and company cards | Paid personal subscriptions, usually $20 to $60 a month | Free tiers, personal cards and vague "software" expenses | 2 hours |
| Invoices and accounts payable | Department purchases and yearly contracts bought without IT | Purchases under the approval limit or on a card | 2 hours |
| Identity provider and SSO logs | Anything staff signed into with a work account, including OAuth grants | Tools used with personal email addresses | 3 hours |
| Browser extension and app inventory | Extensions, plugins, desktop apps and IDE add-ins | Tools used only in a browser tab | 3 hours |
| SaaS discovery tools, if you own them | Approved and unapproved SaaS across devices | Personal devices, personal accounts and one-off web use | Varies |
| Asking people | Almost everything else, and why | Nothing, if done well | 1 week |

### Run a two-week amnesty

Asking finds more than every technical method together. It fails completely if it feels like enforcement, so run it as an amnesty and say so in writing.

> We are listing the AI tools people use for work. This is an inventory, not an investigation.
>
> Nobody will be disciplined for anything reported in the next two weeks. We need the truth for clients and auditors, and to keep the tools people rely on.

Hold to it. If one person is reprimanded during the amnesty, this inventory and every future one is over.

Ask four questions only.

1. Which AI tools do you use for work, including free ones and personal accounts?
2. What do you use them for?
3. What information do you put in?
4. What would break for you if one vanished tomorrow?

People answer the fourth honestly, and it shows which tools now carry real work. Such a tool is no longer shadow AI. It is unmanaged infrastructure.

### Pull the OAuth grants

In a Microsoft or Google tenant, list the third-party apps holding OAuth consent. The query takes twenty minutes. It often finds AI tools that one user's click let into mail, files or calendars.

Those grants outlast the person's use of the tool, and even their departure.

## Part 2: Eleven fields for every tool

Each field answers a question someone will ask later.

| Field | What goes in it | Why it exists |
|---|---|---|
| Tool | The product and the plan in use | Free and paid tiers often have different data terms |
| Owner | A named person, never a department | Someone must answer for the tool, and no owner is your first finding |
| Business use | The real task, in one sentence | Drafting internal email differs from screening job applicants |
| Data entered | Client names, health data, financial records, source code, contract text, or nothing sensitive | This field decides everything after it |
| Model or provider | Who runs the model behind the tool, if disclosed | Your data may reach a party you have never heard of |
| Retention | How long inputs and outputs are kept, and where that is stated | "Unknown" is a finding, so write it down |
| Access | Who inside can use it, and who at the vendor can see the data | Both halves matter |
| Contract | None, click-through, signed, or enterprise with a data processing agreement | Click-through terms are a real contract, usually a bad one |
| Risk tier | 1, 2 or 3, as defined below | Sets how deep and how often to review |
| Approval | Approve, restrict, replace, retire or needs evidence, with a date and name | The decision record |
| Review date | When the row is looked at again | AI terms and models change often, so undated rows go stale in a quarter |

### Three review tiers

Keep it to three. More tiers produce debates, not decisions.

| Tier | Definition | Review |
|---|---|---|
| Tier 1 | Regulated or client-confidential data goes in, output drives a decision about a person, or it touches code or production | Quarterly, and after any change in vendor terms |
| Tier 2 | Internal business data goes in, and a person reviews output before use | Twice a year |
| Tier 3 | Public information only, for drafting or ideas, with no decision power | Yearly |

## Part 3: Six screening questions

Answer each yes or no from evidence, not from the marketing page.

| # | Question | Why it matters | If yes |
|---|---|---|---|
| 1 | **Decisions about people.** Does output shape hiring, promotion, firing, credit, insurance, housing, education or access to care? | Regulators act here first, and errors hurt most | Ask counsel before going further, and document the human review in writing |
| 2 | **Human review.** Does a qualified person check output before use, and can they tell when it is wrong? | Unchecked output is a decision the tool makes | If no, this is your top finding at any tier |
| 3 | **Sensitive data.** Do health, financial account, Social Security, biometric or confidential data go in? | It decides whether a data agreement is required | Sign an agreement with data terms, since click-through terms will not do |
| 4 | **Customer data.** Does your clients' information go in? | Client contracts may forbid it or require notice and consent | Check client agreements first, since some forbid subprocessors |
| 5 | **Source code.** Does your code go in, and does suggested code enter your product? | Your code leaves, and code of unknown origin arrives | Review licensing of suggestions, and require code review |
| 6 | **Training.** Does the vendor train models on your inputs or outputs, and can you stop it? | No deletion request removes content from a training set | Turn it off, get it in writing and record where the setting lives |

Keep questions 1 and 2 separate. A tool can shape decisions with strong human review, or do something harmless with none. Merging them gives the wrong answer both ways.

### The rules, stated accurately

No federal law requires AI certification. NIST's Generative AI Profile (NIST AI 600-1, July 2024) lists voluntary actions for managing generative AI risk. It is guidance with no deadline, so "NIST AI certification" does not exist.

State law holds the dates. Colorado's amended AI law takes effect on 1 January 2027 for covered systems used in consequential decisions. Your counsel decides whether your systems are in scope.

State privacy laws also take effect on staggered dates. Louisiana and Oklahoma start on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. Each has its own thresholds and exemptions by state, entity and data type.

In practice, involve counsel wherever question 1 is yes, since those duties carry real dates. For everything else, the register is the work.

## Part 4: Decide every row

Every row ends in one of five decisions. No row stays blank.

| Decision | Meaning | Record first |
|---|---|---|
| Approve | Keep using as is | A named owner, the data classes, training turned off where it applies, and a review date |
| Restrict | Keep using within named limits | The limits in one sentence a user can follow, and who enforces them |
| Replace | The use is fine, but this tool is wrong | The replacement, the owner of the move and a date, since an undated replacement is a slow retirement |
| Retire | Stop using it | An owner, a date and a check nothing depends on it, by asking question four again |
| Needs evidence | The decision cannot be made yet | The missing fact, who gets it and by when |

"Needs evidence" is the honest answer for most rows on day one. A register still full of it ninety days later records decisions you chose not to make.

Cap "needs evidence" at thirty days per row. When time runs out, the row becomes "restrict" until the evidence arrives. Restriction can be undone, and silence is not a decision.

## Part 5: A sample register

The tools are described generically on purpose, since naming platforms would read as a recommendation. Use real product names in your own register.

### Tools, owners and data

| # | Tool | Owner | Use | Data entered |
|---|---|---|---|---|
| 1 | General assistant, free consumer tier, personal accounts | None at first, now the Director of Operations | Drafting client email and summarising documents | Client names, matter details and some contract text |
| 2 | Meeting transcription and summaries | Sales Manager | Recording and summarising client calls | Call audio, client names and pricing talks |
| 3 | Code completion plugin, individual licences | VP Engineering | Code suggestions in the editor | Proprietary source code and repository context |
| 4 | Marketing copy generator | Marketing Manager | Blog drafts and social posts | Public marketing material only |
| 5 | Resume ranking inside the applicant tracking system | HR Manager | Ranking applicants for review | Names, work history and education |
| 6 | Browser-based document analysis | A paralegal, self-adopted | Summarising discovery documents | Confidential client litigation material |
| 7 | Support reply drafter built into the help desk | Support Lead | First-draft replies | Customer names, ticket history and account identifiers |

### Terms, tiers and decisions

| # | Model or provider | Retention | Access | Contract | Tier | Questions triggered | Decision |
|---|---|---|---|---|---|---|---|
| 1 | Not disclosed | Unknown | 11 staff on personal accounts | Consumer click-through | 1 | 3, 4 and 6 | **Replace** by 30 November with a named business tier that has data terms, owned by the Director of Operations |
| 2 | A named third-party model | 90 days, shown in settings | 6 sales staff | Paid plan, click-through | 1 | 3, 4 and 6 | **Restrict.** Calls about health or financial account data are not recorded, and invites now carry a consent notice |
| 3 | The vendor's own model | Snippets kept per enterprise setting | 14 engineers | Business agreement | 1 | 5 and 6 | **Approve.** Training on private code is off in tenant settings, with a screenshot filed, and code review is already required |
| 4 | Not disclosed | Unknown | 3 marketing staff | Click-through | 3 | None | **Approve.** Public data only, reviewed yearly |
| 5 | A feature of the HR platform | Under the master agreement | 2 HR staff | Signed MSA with no AI terms | 1 | 1 and 2 | **Needs evidence** by 15 October. Counsel reviews decision scope, the human review step is documented and the vendor is asked for model and validation documents |
| 6 | Not disclosed | Unknown | 1 person | Consumer click-through | 1 | 3, 4 and 6 | **Retire** now, since client engagement letters forbid disclosure without consent. A replacement request is open |
| 7 | Not disclosed by the help desk vendor | Unknown | 9 support staff | Existing contract, with AI added in a release | 2 | 4 and 6 | **Needs evidence** by 15 October. The vendor is asked whether it adds a subprocessor and trains on ticket content |

### What the open rows teach

Row 7 matters most, since nobody adopted that tool. The vendor shipped an AI feature into software you already licensed. The data flow changed with no purchase, decision or notice to IT.

Your purchase log will never show this. Add release-note reviews and a written vendor question to the process. Whenever an existing vendor announces an AI feature, the register gets a row.

Row 5 matters next. It triggered question 1, so it stopped being an IT decision.

## Part 6: A one-page standard

Adapt this, since your rules, client contracts and appetite for risk are your own. Have counsel review it before publishing. Its value is its shape: one page a person will read.

> **[Organisation] AI tool use standard**
>
> Effective [date]. Owned by [name, title]. Next review [date].
>
> **Why it exists.** AI tools help us work faster. They can also send information outside the organisation in ways that break our client commitments and legal duties. This standard says which tools you may use and what you may put in them.
>
> **Scope.** It covers every AI tool used for [Organisation] work. That includes free tools, personal accounts, personal devices and AI features added to software we already use.
>
> **The approved list.** The current list is at [location]. A tool not on it is not yet approved for work. Ask [name], and you will hear back within [N] business days, and asking is never held against you.
>
> **Never enter these into any AI tool without written approval.**
>
> - [Client or patient names, and anything that identifies them]
> - [Health information]
> - [Social Security, financial account or payment card numbers]
> - [Passwords, keys, tokens or other credentials]
> - [Proprietary source code]
> - [Contract text, litigation material, or anything privileged or confidential]
> - [Anything you would not email to a stranger]
>
> **Check the output.** You answer for anything you make with AI, as if you wrote it. AI tools write confident text that can be wrong, including invented citations, figures and sources. If you cannot verify it, do not send it.
>
> **Decisions about people.** Do not let an AI tool make or shape a decision about a person. That covers hiring, promotion, discipline, firing, credit, insurance, treatment or access to a service. The exception is a use [name] has approved in writing.
>
> **AI in existing software.** If a vendor switches on a new AI feature in software you use, tell [name]. You do not need to judge it.
>
> **If something goes wrong.** If you entered something you should not have, tell [name] the same day. Prompt reports carry no penalty, and learning later from someone else is a real problem.
>
> **Questions.** [Name], [contact].

The reporting clause protects people on purpose. An organisation that punishes self-reports learns of its exposure from clients instead of staff.

"Asking is never held against you" also matters. A request process that feels like a trap brings shadow AI straight back.

## Part 7: Price products last

Before anyone quotes a governance platform, sort your findings into three groups.

- **Group A costs only attention.** Turn off training in settings you already have, and assign owners. Revoke stale OAuth grants, write the one-page standard, retire unused tools and record data classes. Most organisations find half or more of the work here.
- **Group B costs configuration or a plan change.** Move people from consumer to business tiers of tools they already use, which is often where data terms change. Turn on tenant controls in the identity platform you already pay for, and document human review.
- **Group C costs money.** Discovery tools, a governance platform, or a new platform replacing several unapproved ones.

Finish A and B before pricing C. For any Group C proposal, ask which rows it would have found and which decisions it would have made. A product that hands you another inventory to review by hand repeats work you have done.

If a vendor answers your register with a platform proposal, ask which findings fall in Group A. Then ask why those were not its advice.

## Keep it current

The first pass is a project, and after that a short habit.

| Trigger | Action |
|---|---|
| A request for a new tool | Add a row before approval, never after |
| An existing vendor announces an AI feature | Add a row, with questions 4 and 6 at least |
| Each quarter, for Tier 1 rows | Recheck retention and training settings, which change without notice |
| Any vendor terms update | Recheck the contract and retention fields |
| A staff departure | Reassign their rows, since an unowned Tier 1 row is an open finding |
| A client questionnaire or audit request | Answer from the register, which is the payoff |

When a client asks whether you use AI on their matter, this spreadsheet separates a defensible answer from a guess.

## Keep the register ready

This is general guidance on finding and governing AI tools, not legal advice. Whether a tool or data flow triggers a duty is a legal question for your counsel. That covers state AI law, state privacy law, HIPAA, GLBA, professional rules and your client agreements.

SBK reviews registers, starting with your Tier 1 rows and your "needs evidence" list. Call (718) 407-4169.

Sources

- Microsoft and LinkedIn, 2024 Work Trend Index Annual Report, May 8, 2024
- NIST AI 600-1, Generative AI Profile, July 2024
- Colorado General Assembly enacted AI law, effective January 1, 2027
- IAPP U.S. State Privacy Legislation Tracker, updated June 29, 2026; Venable 2026 Mid-Year State Privacy Law Update, July 30, 2026

---

SBK Consulting · Version 1.0, August 2026 · https://sbkconsultants.com/resources/shadow-ai-tool-register/