Shadow AI Discovery: A 1-Hour AI Inventory for Small Businesses

Shadow AI is any AI tool, workflow or agent your team uses without official approval. You can find most of it in about an hour: ask your team, check your sign-in and app records, review browser extensions and connected apps, and list what you find. Then rank each item by the data it touches and decide whether to keep it, kill it or govern it.

If you think your business doesn’t have shadow AI, you’re in good company, and you’re probably wrong. Pax8’s Q3 2026 SMB AI Pulse surveyed 1,150 small and midsized business leaders in the US, UK, Germany and Sweden. It found that 35% of AI-engaged businesses discovered AI tools, workflows or agents operating without official approval in the past six months alone (Pax8, Oct 12, 2026).

Review hasn’t kept up either. In the US, the same report found 36% of businesses building AI have formal, documented review of what they build. The rest rely on informal checks or none at all. That doesn’t mean your team is doing anything wrong. It means you can’t protect what you can’t see. Here’s how to see it.

---

Before you start: set the tone

Shadow AI is usually a sign of initiative, not bad intent. Someone found a tool that saves them two hours a week. If your inventory feels like a witch hunt, people will hide what they use and you’ll miss the riskiest items. Tell your team up front: “We’re making a list so we can keep the good tools and make them safe. Nobody’s in trouble.”

---

The 1-hour inventory

Step 1 (15 minutes): Ask your team

Send a short, friendly survey or bring it up at your next team meeting. Ask three questions:

1. Which AI tools, chatbots or assistants do you use for work, even occasionally?
2. What do you use them for?
3. What kind of information do you put into them?

Make it easy to answer honestly. A shared form with an “anonymous” option works well.

Step 2 (15 minutes): Check your sign-in and app records

Your systems already know more than you think:

• Microsoft 365 or Google Workspace: review third-party apps users have granted access to their accounts. AI note-takers, writing assistants and calendar tools show up here.
• Single sign-on: if you use it, list every app connected in the last six months.
• Expense reports and card statements: small recurring charges often reveal AI subscriptions that nobody mentioned.

Step 3 (15 minutes): Look at browsers and connected tools

• Browser extensions on a few work computers. AI writing and summarizing extensions can read the pages people open.
• Meeting tools: AI note-takers that join calls automatically.
• Automations: workflows that send data to an AI service, set up by someone who’s since moved on.

Step 4 (15 minutes): List and rank

Put everything in one simple table: tool, who uses it, what for, what data it touches, and whether anyone approved it. Then rank each row:

• High risk: touches client data, financial details, health information, passwords or anything confidential.
• Medium risk: touches internal documents or business plans.
• Low risk: public information only, like rewording a blog post.

---

Keep, kill or govern

For each item on your list, make one of three calls:

Keep. Low-risk, useful and used responsibly. Add it to your approved list so people stop wondering.

Kill. High-risk with no safe way to use it, or a duplicate of something you already approve. Explain why, and point people to the approved alternative so they don’t just find another workaround.

Govern. Useful but risky as currently used. Keep it with guardrails: a business account instead of a personal one, limits on what data goes in, and a named owner who checks how it’s used.

Most items land in “govern”. That’s where the real value is: you keep the time savings and remove the surprise.

---

Turn the list into a policy

An inventory is a snapshot. A policy keeps it current. Write down which tools are approved, what data may never go into AI tools, and how someone asks for a new tool. Our free AI acceptable use policy template gives you a ready-made starting point. If you’re still not sure what to look for, read our guide to the signs of shadow AI in your company.

---

How often to repeat it

New AI tools appear every week, so run a quick version of this inventory every quarter and after any big change, like a new hire wave or a new software rollout. It gets faster each time, because your approved list grows and people learn to ask first.

---

When to bring in help

Do it yourself if you’re a small team with simple systems. Bring in help if your inventory turns up AI touching client or health data, if you need to answer AI questions from clients or insurers, or if you simply don’t have the hour. With 25+ years in technology and security, we run inventories like this as part of an AI governance review aligned to the NIST AI Risk Management Framework.

---

Frequently asked questions

---

If you can think it, we can build it securely. Artificial Intelligence · Security · Applications · Hardware · jrsecuredesign.com