Reviewed
Finding AI tools your team already uses
“Shadow AI” means AI use that sits outside the organization's approved tools or review process. It might be a personal chatbot account, a meeting assistant, an editor extension or a new AI feature inside software the business already pays for. It is a visibility problem, not a useful label for blaming staff.
The first deliverable should be an inventory of tools and uses, with an owner and a decision for each. Do not promise to discover every use. Personal devices, unmanaged accounts and incomplete logs can leave gaps that a technical scan will not resolve.
Ask about work before asking about products
Explain why you are taking the inventory, what information you will collect and how it will be used. Ask staff which tasks they are trying to make easier: writing, coding, summarizing meetings, translating or answering client questions. Then ask which tools they use, under which account, and whether the tool receives files, meeting audio or access to another system.
Invite reports of uncertain uses and near misses. Do not ask people to paste real prompts containing client or employee information into a survey. A description of the task and data category is usually enough for the first pass. An explicit route to request approval is more useful than a list of banned products with no alternative.
Combine conversation with authorized evidence
Within an agreed scope, review purchasing records, approved software inventories, work-account application grants and browser extensions on managed devices. Available cloud discovery or security reports can add evidence, but coverage depends on deployment, licensing and what activity the organization actually observes. A subscription record does not prove what information entered a tool; an absent log entry does not prove a tool was never used.
Do not turn an AI inventory into covert employee surveillance. Involve the appropriate privacy, HR and security owners before collecting activity data. Define purpose, access, retention and the notice staff receive. Avoid collecting prompt contents or private account information by default. The OPC's business guidance on AI and Canadian generative AI privacy principles are useful starting points for checking whether your own discovery process respects privacy, not only whether the tools do.
Record the use, account and data together
For each use, capture:
- The tool, provider, feature and work or personal account type.
- The business task, team and accountable owner.
- The data categories involved, without copying the underlying sensitive content.
- Connected systems and permissions, including whether the tool can take actions.
- The current decision, evidence still needed and next review date.
Keep “not yet known” separate from “not used.” Two teams using the same brand may have different accounts, terms and connectors. Likewise, a tool approved for public marketing drafts is not automatically approved for client contracts or employee records. Review the use, not just the logo.
Prioritize the decisions that matter most
Start with uses involving credentials, sensitive personal information, confidential client material, broad connectors or action-taking permissions. If there may have been a disclosure, use the organization's incident process; do not wait for the inventory to be complete.
Assign each use a practical next step: approved for a defined purpose, allowed only under stated conditions, paused pending review, or replaced with an approved option. Name who can make the decision and who will help the team change its workflow. Before removing an integration, assess what access it has, what records must be preserved and how to revoke permissions safely. Deleting a local conversation alone may not remove provider-held data.
For Microsoft 365 Copilot uses, review the product-specific privacy documentation and existing permissions. Do not extend its enterprise data commitments to unrelated tools or personal accounts.
Make the inventory maintainable
Keep one register with decisions and owners rather than a spreadsheet of tool names that nobody revisits. Review it when a supplier changes terms, a product adds AI features, a connector is enabled or a team changes the data it uses. Publish a short acceptable-use policy and a visible request channel, then show staff how to use both.
The result is a clearer view of known AI use, unresolved questions and approved alternatives. It is not proof that every tool has been found. This is general readiness guidance, not legal advice; confirm privacy, employment and contractual obligations with qualified professionals.
Source: https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/ai_business/. General readiness guidance — not legal advice.