Shadow AI assessment with an AI usage policy
We find out which AI tools your employees use, what data they put into them, and where sensitive information could leak. We then write a usage policy based on the findings.
When you need it
The AI use nobody knows about
Employees use AI tools even when the company has not officially introduced any. We covered this in our article Shadow AI: when employees use AI without approval.
Subscribed without anyone knowing
A department pays for an AI tool by card, uploads its own data, and nobody knows about it. This is the new form of shadow IT.
Client data in a public service
When someone pastes a draft contract or client data into a public AI service, that data leaves the organization. This is typically a data transfer with no legal basis and no data processing agreement, and the protection of trade secrets may be lost.
Adoption first, thinking later
Many organizations adopt AI under business pressure, so security questions often come up only afterward.
How the assessment works
From inventory to policy
We first look at what happens in the organization today, and only then write down the rules.
-
Discovery
From proxy and firewall logs we list which AI services are reached from inside the organization, and at what volume. In our experience the result is almost always a surprise.
-
Risk classification
For each tool we check how sensitive the data going into it is, whether that data leaves the organization, and if so, whether a contract and a legal basis cover it.
-
Usage policy
The policy for employees is built on the tools and data found in the inventory.
-
Technical controls
A policy on its own does not stop sensitive data from ending up in an AI tool. Where technical protection is needed for that, we recommend what to put in place.
Deliverables
What you get at the end
items handed over
- Inventory of the AI tools in use and their data flows
- Risk classification for each tool
- AI usage policy for employees
- Recommendations for the technical controls needed
Related services
After the assessment
We also deliver the recommended controls and employee training as separate services.
AI security controls deployment
Vendor AI security solutions that make the use of AI services visible and controllable, and filter out malicious instructions.
GenAI data loss prevention
Data loss prevention rules written specifically for traffic going to AI services.
Security and AI usage training
Live training tailored to your company, for managers and staff. The goal is for employees to apply the policy in their daily work.
Frequently asked questions
Before you regulate AI use
Isn’t it enough to block public AI services?
Blocking alone does not work, because employees find ways around it. It has to come with a usable alternative, such as an enterprise subscription with a data processing agreement, or a locally run model.
What does the AI usage policy cover?
It makes clear to employees which AI tools they may use and what data they are allowed to enter into them.
Are there risks with a locally run model too?
Yes. With a local deployment the data does not go to a third party, but prompt injection and permission issues remain wherever the model is installed. We cover them in detail in our article Security risks of enterprise AI adoption.
