Shadow AI Inventory: Review Unmanaged Tools and Data Flows

An “unmanaged” AI tool is one being used without a clear organizational owner or review path. That does not by itself mean the tool is unsafe or that data has been exposed. It does mean the organization may not know what vendors, models, accounts, or data flows are involved.

Build a short inventory

Ask each team to identify the tools they use for work. For every tool or workflow, record:

• the vendor, product, account type, and business owner;
• the task it supports and the systems it connects to;
• the information people enter or retrieve;
• whether output is sent to customers, used in decisions, or written into a business record;
• the reviewer, exception path, and way to stop the workflow.

Avoid collecting prompts or copied client material in the inventory unless there is a clear need and an approved storage location. A high-level description of the task and data category is usually enough to decide what needs a closer review.

Triage each use

Start with tools that handle personal, client, financial, health, confidential, or security-sensitive information; tools connected to business systems; and tools that take actions without a person reviewing the result. Check vendor terms, account access, data retention and training settings, subprocessors, and whether the tool can be restricted to the intended use.

Then record a decision: allow within defined boundaries, restrict until a change is made, or do not use for the proposed task. Name the person who can approve an exception and the person who will review output.

Example

An employee may use a public assistant to draft a generic email without including client details. A workflow that summarizes client messages inside a connected CRM needs a separate review of vendor terms, access controls, data handling, and staff approval before those messages are processed.

Limits and next step

An inventory is a starting point, not proof that a data breach occurred or that a tool meets a regulatory or contractual requirement. After documenting the current uses, choose one high-priority workflow and validate its data path and review controls before expanding it.