Governance shadow AIAI governancerisk scoringEU AI Act

Shadow AI Inventory & Risk Scoring Workbook

Discover, inventory, and score every unapproved AI tool in your environment — 10 tabs, 589 formulas, pre-seeded with 15 real-world shadow AI tools and a defensible 10-factor risk model.

What this actually gives you

Pre-seeded with 15 real tools — ChatGPT, Claude, Copilot, M365 Copilot, Gemini, Notion AI, Grammarly, Perplexity, Jasper, Otter.ai, Fireflies, Cursor, custom GPTs, Zapier AI, ElevenLabs — so you recognise your own environment immediately.
A 10-factor weighted risk model summing to 100: data sensitivity (25), training on data (15), account type (12), retention (10), SSO (8), access scope (8), user count (6), criticality (6), regulatory (6), agentic (4).
A 5×4 heatmap of data sensitivity against risk tier, showing where shadow AI concentrates rather than just that it exists.
Governance tier scored MATURE / DEVELOPING / AD-HOC / REACTIVE / AT RISK, with a live top-10 highest-risk tools list and recommended actions.

Shadow AI is already inside your org. The question is whether you know what's there, who's using it, and what it's doing with your data. This workbook gives you a structured, defensible methodology to find it, classify it, and govern it — built for the 2026 enforcement environment.

Pre-seeded with 15 real tools (ChatGPT, Claude, Copilot, M365 Copilot, Gemini, Notion AI, Grammarly, Perplexity, Jasper, Otter.ai, Fireflies, Cursor, Custom GPTs, Zapier AI, ElevenLabs) so you recognize your own environment immediately.

Risk Scoring — a 10-factor weighted model summing to 100: Data Sensitivity (25), Training on Data (15), Account Type (12), Retention (10), SSO (8), Access Scope (8), User Count (6), Criticality (6), Regulatory (6), Agentic (4). Every weight is documented and tunable. Auto-produces a tier (Low / Medium / High / Critical) and recommended action per tool.

Risk Heatmap — 5×4 matrix (Data Sensitivity × Risk Tier) showing where shadow AI concentrates across your environment.

Dashboard — six top-line KPIs, Governance Maturity Score, Governance Tier (MATURE / DEVELOPING / AD-HOC / REACTIVE / AT RISK), and a live Top 10 highest-risk tools ranked by formula with recommended actions.

Also includes: Discovery Survey (10 questions, amnesty-program framing), AI Tool Inventory (21 attributes per tool), Decisions Log (pre-seeded with 4 governance decisions), 22-control Policy Tracker, Data Classification reference table, and 17-term Glossary.

Regulatory alignment: EU AI Act (Articles 16, 50, 61), NIST AI RMF (Govern/Map/Measure/Manage), ISO/IEC 42001. Specific to 2026 deadlines, not generic compliance boilerplate.

The 450-paragraph User Guide covers all six discovery channels, vendor-specific inventory guidance for OpenAI/Anthropic/Google/Microsoft/GitHub, scoring methodology with weight-tuning guidance, a complete week-by-week amnesty program playbook, a 1-page AI policy template, and full regulatory mapping.

Also available in 4 bundles

This product is sold on its own and as part of a set. If you need more than this one, the set is cheaper than buying the parts.

2 products saves $105.00

Phase 0 + Shadow AI Pack

The assessment that finds every AI system in your estate, paired with the workbook that inventories and scores them. Map the footprint, then govern it. 14% off buying separately.

$593.00

4 products saves $209.00

Risk & Readiness Pack

Ransomware Readiness + Tabletop Exercise Pack + Cyber Insurance Workbook + Shadow AI Inventory — show underwriters and your CEO your program maturity. 19% off list.

$837.00

5 products saves $311.00

Phase 0 + Risk & Readiness Pack

The front-door assessment plus the four workbooks that prove readiness to the people who ask — ransomware, tabletop, cyber insurance and shadow AI. 24% off buying separately.

$934.00

3 products saves $259.00

vCISO Ops Bundle

vCISO Client-in-a-Box + Shadow AI Inventory + CISO Budget Workbook — the three tools every vCISO needs to run a full program. 19% off individual pricing.

$1038.00