Shadow AI: Governance Response

Shadow AI is AI use that sits outside an organisation's approved systems and processes. The governance response should establish what is happening, contain material exposure and provide a workable decision about the underlying business need. A blanket announcement or a count of blocked websites does not accomplish those tasks.

For Saudi organisations, the important questions are specific: which service receives which information, through whose account, for what purpose, and with what ability to affect customers or systems? A browser extension that automatically reads attachments can create a different exposure from an employee manually entering a public question into the same supplier's website.

The UK National Cyber Security Centre's shadow AI guidance emphasises understanding employee needs and encouraging communication. That is a useful starting point for discovery. The operating design below shows how to turn disclosures and technical signals into recorded decisions without confusing visibility, permission and incident resolution. It is designed for security, IT, HR, procurement and business owners working together.

Define shadow AI by the use path, not the product logo

A tool can be approved for one task and still be used outside its approved boundary. A staff member may connect a new repository, switch to a personal account, enable a browser extension or share an assistant with another team. The relevant record therefore includes the task, environment, data path, audience and action capabilities.

Separate undisclosed use from prohibited use. An activity may be absent from the inventory because the catalogue is incomplete, the product introduced a feature quietly or employees could not find the request route. These circumstances require investigation. They do not automatically establish that no harm occurred, but neither do they establish intentional misconduct.

Use a clear working definition in the campaign. Ask employees to report work-related AI activities that they cannot match to an approved entry, including embedded features and tools paid for personally. Explain that the review will decide whether the activity can continue, needs conditions, should move to an approved service or must stop. The acceptable-use policy should make these boundaries visible after discovery.

Create a reporting channel people will actually use

Ask for a short initial account: the task, tool or feature, account type, information categories, whether anything is connected automatically and whether the output is shared or acted upon. Let employees answer “not sure”. A request for technical details they cannot know can discourage reporting and produce invented certainty.

Explain who sees the report and how it will be used. Avoid making an unrestricted spreadsheet of employee disclosures, prompts and customer names. The discovery record can contain sensitive business or personal information. Use controlled access and collect the minimum detail needed to route the review, with separate evidence handling for incidents.

A constructive campaign is not an unlimited amnesty or a promise that serious misconduct will be ignored. HR and legal owners should approve the communication. The practical commitment is that good-faith disclosure will receive a useful response and that the organisation will investigate facts before drawing conclusions. Managers should be prepared to identify the business pressure or service gap behind the activity.

Combine disclosures with technical evidence carefully

Technical signals can identify candidate services, but each has a coverage boundary. Browser-extension inventories, expense records, approved application lists, identity logs and network observations reveal different parts of the picture. Reconcile them through an authorised process rather than assuming one source provides a complete inventory.

For example, Microsoft's Global Secure Access shadow AI discovery documentation describes a network-based feature that identifies AI-service traffic. Such a signal supports investigation; it does not by itself reveal the full prompt, business purpose or whether the activity was authorised. The governance record should distinguish the observed fact from an inference that still needs confirmation.

Plan monitoring with the appropriate privacy, security and employee-relations owners. Define the purpose, scope, access and retention of the discovery data. Do not collect all employee content simply because the project is called AI governance. Targeted evidence about an identified exposure can be more useful than a large, difficult-to-review archive of unrelated activity.

Worked example: a quote-summarising browser extension

Consider a fictional purchasing team that uses a browser extension to summarise supplier quotations. During a discovery exercise, employees submit 18 reports. Reconciliation identifies seven tool products but 12 distinct use paths, because some tools are used through different accounts, features or information sources. These are illustrative inventory counts, not a measured prevalence estimate.

One path concerns the quote extension. The employee believed it processed only text selected on screen. A controlled inspection shows that the enabled feature can read attached quotation documents automatically. The team has not yet established the supplier's retention arrangement or support access for those documents. The discovery record therefore distinguishes a demonstrated collection capability from unresolved downstream handling.

Illustrative disposition of the extension use path

Finding	Immediate response	Follow-up owner
Automatic attachment access differs from staff understanding	Pause the affected feature and preserve the configuration evidence	IT administrator and security
Commercial quotations may have been processed	Establish the affected period and document population without wider circulation	Information owner with incident triage
Retention and support access are unresolved	Request service-specific evidence; keep uncertainty visible	Procurement and privacy reviewers
Employees still need quotation summaries	Provide an approved manual or controlled alternative	Purchasing process owner

Disabling the extension addresses future activity through that route; it does not prove that previously transferred copies were deleted. A supplier's general privacy statement also does not establish the exact feature configuration. The review should preserve this distinction until the relevant evidence supports a conclusion.

The 18 reports are not closed merely because seven product names have been listed. Each of the 12 use paths needs an owner and a disposition. Duplicate reports can be linked to one path while retaining useful evidence about its scope. The purchasing team should receive an answer about how to complete the work, not only a notification that a tool was blocked.

Triage exposure before deciding long-term approval

Initial triage asks whether there is a current or possible material problem requiring immediate action. Relevant considerations include information sensitivity, external recipients, privileged access, autonomous actions and the ability to limit continued processing. Use the organisation's established incident process when warranted; discovery staff should not invent a parallel investigation with different evidence rules.

Record what is known, what is reasonably suspected and what remains unknown. If an employee cannot identify which attachments were processed, that is a gap to investigate, not permission to assume the smallest possible scope. Conversely, the mere presence of an AI-domain connection does not establish that confidential documents were uploaded.

Separate containment authority from approval authority. Security may be able to disable a connection promptly, while the business owner, privacy team and procurement determine whether a controlled future use is viable. The AI incident response plan should define escalation and evidence preservation; the approval workflow decides future operation after the relevant conditions are resolved.

Choose among four dispositions

A discovered use normally needs one of four explicit outcomes: approve within a documented boundary, permit a time-limited controlled evaluation, migrate to an approved alternative, or stop the activity. Each outcome should state the task and information it covers. “Approved tool” is too broad when the original issue concerned a particular connector or account arrangement.

Disposition choices for discovered AI use

Outcome	Evidence needed	Closure condition
Bounded approval	Task, data handling, configuration and owner are acceptable under applicable requirements	Catalogue entry and controls match the approved use
Controlled evaluation	Useful question, limited inputs and explicit temporary conditions	Evaluation ends or receives a new recorded decision
Migration	Approved alternative meets the necessary work requirement	Users and required records move through an agreed process
Stop	Activity cannot meet the necessary conditions or is not justified	Relevant access is removed and residual handling is addressed

Do not use “pending review” as a permanent fifth outcome. If temporary operation is allowed, that is an exception with an owner, boundary and expiry. If it is not allowed, tell users what they should do instead. The exception-management process should prevent a discovery queue from quietly becoming an unmanaged permission system.

Investigate the unmet need behind repeated use

Interview the process owner about the job employees were trying to complete. Was the approved tool unavailable, difficult to access, unsuitable for Arabic documents or too slow for the workflow? Was the request process unclear? Different causes need different responses. Buying another licence will not fix a review process that nobody owns.

In the quotation example, the need is to compare commercial terms efficiently. The approved alternative might provide structured extraction from a controlled source, or the team may improve the quotation template so less summarisation is required. The governance objective is to solve the work problem within acceptable boundaries, not to preserve the unofficial tool at any cost.

Measure the alternative on the actual task. Ask whether it preserves exclusions, delivery conditions, currencies and uncertain terms, and whether users can trace a summary back to the quotation. A tool that feels slower because it exposes necessary review may still be the appropriate route. Make the tradeoff explicit rather than promising identical convenience with no conditions.

Manage historical copies and account ownership

Stopping new use leaves questions about existing prompts, uploaded files, generated outputs, shared links and connected credentials. Identify which records are needed for investigation or business continuity before requesting deletion. Follow the relevant retention and evidence-preservation requirements, and record the authority for the action.

Personal accounts create an ownership challenge. The organisation may not control the account or be entitled to inspect unrelated personal material. Work with the employee and the appropriate internal owners to establish a lawful, proportionate route for work-related records and access removal. Do not treat an AI governance review as permission to demand unrestricted access to a person's private account.

Request deletion or export evidence at the level the supplier can actually provide. A confirmation about an account may not cover backups, support records or a separate integrated service. Record contractual commitments and technical evidence separately. Unresolved historical handling can remain an open investigation even after the future business workflow has moved to an approved system.

Use metrics that reveal decisions and residual exposure

Count distinct use paths, assigned owners, overdue triage and completed dispositions. Track the reason a review is blocked: missing supplier evidence, unclear information ownership, unavailable alternative or unresolved incident. These measures tell management where to intervene. A high number of disclosures may indicate improved visibility rather than worsening behaviour.

Avoid reporting blocked domains as the number of AI risks eliminated. One domain can support several uses, while an embedded capability may share an ordinary business-software domain. Similarly, employee report counts, product counts and processing-path counts describe different things. Keep the denominator and reporting period visible.

For the illustrative exercise, report 18 disclosures reconciled to seven products and 12 use paths, then show the state of those 12 paths. Do not turn the count into a workforce adoption percentage without a suitable population and method. The governance metrics guide can help connect these operational states to executive reporting.

Prevent rediscovery from becoming the normal operating model

Feed approved discoveries into the inventory and procurement process. A renewal should ask whether the supplier has added AI features, and application owners should have a route to report new capabilities. The purchased and embedded AI governance process is especially important where an existing platform changes without a new purchase request.

Make the approved catalogue searchable by task as well as product. Employees looking for quotation summarisation may not know which platform offers the approved function. Include the permitted information and a direct help route. Keep the catalogue current enough that people do not learn that its instructions are routinely wrong.

Review a sample of closed cases later to check whether the agreed outcome still holds. Has the extension returned? Did the alternative meet the need? Has the account changed? This is a targeted follow-up on a known decision, not an excuse for unlimited surveillance. Use the findings to improve the process and the employee guidance.

Reconcile conflicting discovery signals

Build a small reconciliation queue for cases where evidence disagrees. An employee may report that a personal account is no longer used while a network signal still appears. The signal might reflect an active session, a different employee, a browser background request or another feature sharing the same service. None of those explanations should be accepted without appropriate checking.

Record the observation, source, time, confidence and question to resolve. Ask the owner for the least intrusive evidence that can answer it. A narrowly scoped configuration check may establish that an extension remains enabled; a network record alone may not identify which documents were processed. Preserve that distinction in both the case record and management reporting.

For the quote-summary example, link the relevant disclosure to the extension's actual permissions and account arrangement. If several employees report the same route, retain a common investigation while recording any materially different settings. Avoid opening unrelated duplicate cases, but do not merge away a personal-account path simply because the product name matches the corporate version.

Define closure separately for access, records and the work itself

A migration has at least three practical questions: has the old route stopped, have historical records and obligations been dealt with, and can the business now perform the necessary task through an accepted route? A case may be complete on one question and open on another. Use separate fields instead of one green status that conceals the remaining work.

For example, the extension may be disabled and an approved summarisation workflow available, while the supplier's response about prior support access is still pending. Report that position accurately. Do not reopen future-use approval merely because historic evidence remains incomplete, and do not close the historic investigation merely because staff have moved tools.

At handover, give the application owner the approved route, users, restrictions and reopening triggers. Give the incident owner any unresolved historical matters. Give the process owner the remaining usability issues. This division helps the organisation avoid a familiar failure: security considers the task closed, employees still lack a workable route and the same unapproved use quietly reappears.

Set up a response that closes the operational loop

The completed response should connect discovery, triage, disposition and follow-through. For each use path, someone can explain the task, evidence, decision, current configuration and remaining obligations. A governance team should be able to distinguish a closed approval from a closed investigation and a completed migration.

Bring existing disclosures, application lists and a few unresolved use paths to a governance setup discussion about shadow AI. Through AI governance setup, the organisation can establish a proportionate reporting and review process that helps staff complete useful work while making exposure and authority visible.