Shadow AI self-check

Six questions about your own tenant. Answer them as they actually are today, not as the policy says they should be. Your rating appears as soon as all six are answered — no email address required.

0 of 6 answered

1. 1. Could you name the AI tools your staff used last week?

   No, and I would be guessingThe main ones, informallyYes, from a maintained inventory

2. 2. Can staff grant a third-party app access to their mail and files on their own?

   Yes, or we have never checked the settingOnly for lower-impact permissionsNo — admin consent is required and requests are reviewed

3. 3. Is there a current written statement of what may be put into an AI tool?

   None, or it was a conversation onceSomething written, out of date or unacknowledgedCurrent, issued, and acknowledged by staff

4. 4. Have you given staff a sanctioned tool that does the job they are reaching for?

   No — the position is essentially don'tLicensed, but never properly rolled outYes, and it is genuinely in daily use

5. 5. If a client asked today which AI tools touch their matter, could you answer in writing?

   NoRoughly, but not with evidence behind itYes, with a register we could hand over

6. 6. When someone leaves, are the third-party apps they authorised revoked?

   Unclear — we disable the account and move onSometimes, if someone remembersExplicitly revoked against a documented checklist