Shadow AI Finder

Shadow AI policy template

A short AI tools policy that gives people approved options instead of a ban. Edit it below; nothing you type leaves your browser.

A template, not legal advice. Adapt it to your organisation and the laws that apply to you.

Policy text

AI tools policy (shadow AI)
[Company name] · Version 1.0 · Approved by [name, role] on [date] · Review every 6 months

1. Purpose
We want people to use AI tools that help them, in a way that keeps company, client and personal data safe. This policy says which tools are approved, what may be shared with them, and how to ask for a new one.

2. Scope
Every employee, contractor and temporary worker, on company or personal devices, whenever the work involves company, client or personal data. It covers chat assistants, writing and translation tools, coding assistants, meeting recorders, document and research tools, image, video and voice generators, AI features inside existing software, browser extensions, and AI agents that act on someone's behalf.

3. Approved tools
The approved list is kept at [location]. Only approved tools may be used with company data, signed in with a company account. Using an unapproved tool for work is not allowed, but asking for one to be approved is encouraged (section 7).

4. What you may and may not share
- Never enter: passwords, keys or tokens; client data covered by a contract; personal data about customers or staff; health, financial or HR records; unreleased financial results; source code marked confidential.
- Public or already-published information may be used with any approved tool.
- Internal information may be used only with tools marked "internal data allowed" on the approved list.
- If in doubt, don't paste it; ask [contact].

5. AI agents and automations
- No agent, automation or script may call an AI service with company data unless it is registered at [location] with a named owner.
- Each agent gets its own credentials with the least access its job needs; never a person's account.
- Actions that send, pay, delete or change access need approval from a person before they take effect.
- Every agent must be able to be switched off at once, and its actions must be logged.

6. Checking what AI does
AI output can be wrong. The person who uses it is responsible for checking it before it's sent, published or used for a decision. Say when a document was substantially produced with AI if the reader would expect to know.

7. Asking for a new tool
Send the tool's name, what you want it for and what data it would see to [contact]. We aim to answer within [5] working days. We check where data goes, how long it's kept, whether it's used for training, and the contract terms.

8. Training
Everyone who uses AI tools at work completes the AI awareness session when they join and once a year. Records are kept by [team].

9. Monitoring
IT reviews DNS, proxy and sign-in logs for AI services [monthly] to keep the approved list current. The aim is to find tools people need, not to discipline them.

10. Breaches
Report any accidental sharing of restricted data with an AI tool to [contact] straight away. Quick reporting is treated as the right thing to do.

Owner: [name, role]. Questions: [contact].

How to use it

Run the Shadow AI Finder on a week of logs to see which tools people already use.
Approve the ones people need, on business terms, and list them where everyone can find them.
Fill in the brackets, get the policy approved, and train people on it.
Repeat the log check monthly and update the approved list.

Why section 8 is there

In the EU, the AI Act requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy of their staff (Article 4, applying since 2 February 2025). A training record is simple evidence of those measures. The European Commission's AI literacy Q&A explains what it expects.

Sources

Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
European Commission: AI literacy, questions and answers
Checked 28 September 2026.