What Is Shadow AI? Risks and 10 Essential Controls
Shadow AI is employees using AI tools without approval. Why it happens, the risks it brings and how to bring it under control without simply banning it: 10 essential controls.
Read more →GenAI Usage Risk Assessment
Your employees already use ChatGPT and similar tools. The question is whether they do so with controls or without. This assessment reviews 10 essential controls for generative AI use and lists your gaps.
- 2 min
- 10 questions
- IT, information security, compliance and HR leaders
What does it measure?
- Policy and tools: usage policy, approved tools, contractual safeguards
- Data protection: data classification, privacy law and cross-border transfers
- People and process: training, human review, incident reporting, shadow AI and agent permissions
How is it scored?
For each question you pick the option that best describes your organisation; options run from no control at all to a fully working control (0–3 points). Your control maturity is calculated as a percentage and converted to a risk level. Missing or partial controls are listed with what needs to be done.
Frequently Asked Questions
Why does "We don't know" count as a risk?
If nobody knows whether a control exists, it can't be assumed to work in practice, which is as risky as not having it.
Is this enough for data protection compliance?
No. This is an initial self-assessment. Compliance with data protection and other regulations requires legal review.
What should I do after getting my result?
For most organisations the first steps are a short usage policy, a list of approved tools and safe-use training for all employees.
Related articles
All assessments
AI Maturity Assessment
Measure your organisation's AI maturity across 6 dimensions: strategy, data, technology, people, governance and culture.
Start now →AI Literacy Quiz
Test your AI knowledge and safe-use habits in 10 questions. Share it with your team.
Start now →EU AI Act: Am I in Scope?
Is your AI system in scope of the EU AI Act, which risk category does it fall into, and which obligations apply from when?
Start now →MLOps Maturity Assessment
Measure the MLOps maturity of your model development and deployment in 12 questions; see your level (0–4) and next steps.
Start now →Training Finder: Which AI Training Is Right for You?
Answer a few short questions and see the AI training programmes that suit your team as an ordered path, with the reason for each.
Start now →