Shadow AI Audit: Find Out Which AI Tools Your Team Is Actually Using

Yes — the 30-minute call and the AI Acceptable Use Policy template are free, with no obligation afterwards. We run them because the businesses that need AI rules usually don’t know where to start, and half an hour of plain conversation is the fastest way to find out whether we’re a useful fit for each other. If you want help implementing anything afterwards, that’s a separate quoted piece of work you’re free to decline.

No, and most people don’t — that’s the normal starting point. If you want a head start, ask your team which AI tools they already use for work and make it clear there’s no penalty for answering honestly. Whatever list you come back with makes the call sharper, but an empty list is fine too; we’ll work out how to find out.

Whoever can make decisions about what’s allowed — usually the owner or a manager, because approving tools and setting information rules are business decisions rather than IT ones. If you have an operations, HR or compliance lead, bringing them in helps, since several sections of the policy touch their areas. One person is enough to make it worthwhile.

It’s a real 30-minute working session, and we’d obviously like to work with you afterwards. There’s no slide deck about us, no pricing conversation unless you ask for one, and the policy template is yours whether or not anything else follows. The closest thing to a pitch is one question at the end about whether you’d like help.

No. The audit call is a conversation — nothing gets connected, installed or scanned. If you later want us to look at what’s actually connected inside your Microsoft 365 or Google Workspace tenant, that’s a separate engagement with your written authorisation, and we’ll be clear about what it involves before anything happens.

Usually not, because handbooks written before AI arrived don’t answer the questions people are actually asking. A handbook tends to cover confidentiality in general terms; what staff need is specifically which tools are approved, what information can go into them, and who to ask when something isn’t on the list. The AI policy can be a short appendix to the handbook rather than a separate document — what matters is that the blanks get filled.

You can, and some businesses in regulated work reasonably do, but it’s harder to hold than it looks. A ban moves the usage onto personal accounts and personal devices where you can’t see it, which leaves you with the same risk and less visibility. If you do want a prohibition, write it down, say why, and give people a route to ask for exceptions — an unwritten ban is just an assumption.

Lead with the reason, not the rule. People follow a policy they understand: this is about protecting client information and the business, here are the tools you can use and what for, here’s what can’t go into them, and here’s who to ask about anything else. Then tell them how to report a mistake quickly and make clear that self-reporting is welcome, because the alternative is finding out late.

If you handle protected health information, AI use needs to be checked against your own compliance obligations — including whether a vendor agreement such as a Business Associate Agreement is in place for the specific tool and plan — and that check belongs with your compliance officer or counsel, not with us. What we can do is help you set up the controls around it: an approved-tools list, access and settings, and rules that keep regulated information out of tools that aren’t cleared for it. The same goes for client contracts, which often sit above your own policy.

Yes, if you want it. That usually means adapting the policy to your business, reviewing the specific tools your team wants, putting sensible settings and access restrictions in place, and walking your team through the agreed rules. Have a look at the template first and tell us where you’d like a hand — we’d rather do the part you actually need than sell a package.