Home/BoK/Templates/Shadow AI Discovery Checklist
Back to Hub
Last Reviewed: 2026-06-25
Reviewer Role: Insider Risk / Legal / Privacy review
Advanced Asset
Monitoring ModuleInteractive Sheet

Shadow AI Discovery Checklist

A shadow AI discovery checklist helps identify AI tools and workflows used outside approved governance, security, procurement, or data protection processes.

Primary Audience & Scope

Security, IT, Privacy, data owners, AI governance

When to Use

  • •Building or reviewing the related program activity.
  • •Preparing a repeatable workflow.
  • •Creating site-downloadable working content.

Interactive Work Area

Fill or track items interactively and copy out to your Clipboard

Template Table Structure

FieldWorking promptTemplate fieldReader input
Resource owner—Review date—
Scope—Relevant system/data/process—
Business owner—Control or procedure link—
Evidence location—Action owner—
StatusNot started / in progress / complete / exception——

Checklist Audit List

0% Done(0/8)
Check
Checklist item

Review browser/security logs for AI domains.

Evidence: Owner / date / evidence

Review CASB/SSE/SaaS discovery for AI services.

Evidence: Owner / date / evidence

Review DLP events involving prompts, uploads, and AI domains.

Evidence: Owner / date / evidence

Review expense and procurement data for AI subscriptions.

Evidence: Owner / date / evidence

Survey teams for business AI use cases.

Evidence: Owner / date / evidence

Classify discovered tools by data sensitivity and business need.

Evidence: Owner / date / evidence

Assign owner and remediation path.

Evidence: Owner / date / evidence

Update approved AI catalog and training.

Evidence: Owner / date / evidence

What Completion Looks Like

  • 1Required inputs complete.
  • 2Action owners assigned.
  • 3Evidence retained.
  • 4Related risk/control/procedure linked.
  • 5Review cadence established.

Insider Risk Capability Framework™ (IRCF™) Alignment

Primary IRCF™ Component
Monitoring
Programmatic RelevanceProvides concrete, reusable structure for insider risk management work.
Non-legal-advice Compliance NoteThis resource is a planning aid and does not provide legal advice. Organizations should adapt it to their policies, jurisdictions, labor obligations, privacy requirements, contracts, and risk appetite. Sensitive monitoring, investigation, employment, evidence, legal hold, and employee-data activities should be reviewed by appropriate Legal, Privacy, HR, Compliance, and labor stakeholders before use.

Operationalize This Template in RiskTKO®

Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. DLP Policy Review Checklist

Request an Insider Risk AssessmentSee RiskTKO® in Action