AI Discovery and Shadow AI Procedure

1. Purpose

To find AI already in use at [CLIENT NAME] — before governance starts and on an ongoing basis — decide what to do with each finding, and move staff from unapproved (T0) tools to approved tools with minimal disruption, so that the AI System Register (AGK-TPL-01) and Connector & Tool Registry (AGK-TPL-02) reflect reality.

2. Scope

• AI tools, SaaS products with AI features, browser extensions, desktop apps, connectors and add-ons used for [CLIENT NAME] business, whether paid by the company, expensed, or free.

• AI features newly enabled by vendors inside existing approved software.

• All staff, contractors and temporary workers with access to [CLIENT NAME] systems or data.

• Out of scope: AI systems already registered and reviewed under AGK-PRC-05 (they are reconciled, not rediscovered).

3. Triggers

• Adoption of the AGK (full discovery, once).

• Light discovery every [quarter].

• An incident or near miss involving an unapproved AI tool (AGK-PRC-04).

• Merger, acquisition or onboarding of a new business unit.

• A vendor announces or enables a new AI feature in software already in use.

4. Discovery sources

Use as many sources as are available. Combining two or three gives a reasonable picture; no single source finds everything.

Source	What it finds	Owner	Lite?
SaaS discovery / CASB or secure web gateway logs	Sanctioned and unsanctioned AI web apps in use, users, volumes, uploads	[IT Security]	If available
DNS / proxy logs for known AI domains	Visits to AI services, by device or user, over the last [90 days]	[IT Security]	If available
Browser extension inventory (device management)	AI extensions and sidebar assistants installed on managed browsers	[IT Operations]	Yes, if devices are managed
Expense and corporate card data	AI subscriptions bought individually or by teams (search vendor names and “AI”, “GPT”, “assistant”)	[Finance]	Yes
App marketplace / OAuth grants in the productivity suite	Third-party AI apps granted access to mail, files or calendars; scopes granted	[AI Platform Administrator]	Yes
AI features inside existing SaaS	AI features enabled by default or by admins in CRM, HR, finance, helpdesk, design and meeting tools	[Application owners]	Yes
Staff survey	What people use, for what, and with what data — including personal devices and accounts not visible in logs	[AI Governance Lead]	Yes

Staff AI-use survey (short form)

Keep it anonymous by default, under [5 minutes], and send it with the amnesty message.

1. Which AI tools have you used for work in the last [3 months]? (list; include free and personal accounts)

2. Do you use a personal or a company account for each tool?

3. What do you mainly use them for? (writing, summarising, research, coding, analysis, images, meetings, other)

4. How often? (daily / weekly / monthly / rarely)

5. What kind of information have you put into them? (public only / internal documents / customer or staff personal data / financial or confidential / source code)

6. Have you installed any AI browser extensions, desktop apps or meeting note-takers?

7. Have you connected an AI tool to your work email, files, calendar or other systems?

8. Which AI features have you noticed switched on in software we already use?

9. What tasks would you most like AI help with if an approved tool were available?

10. Anything that worries you about AI at work? (free text)

5. Classifying findings

Each discovered tool or feature shall be classified into one of four outcomes by the AI Governance Lead, using AGK-STD-A02 AI Data Handling Standard and the tool tiers in AGK-000.