To find shadow AI in your company, look where unapproved tools leave records: OAuth grants in your identity provider, sign-in and network logs, expense reports, browser extensions and AI features switched on inside software you already pay for. Then ask people directly, because an anonymous survey is the only method that reaches personal accounts on personal devices.
Shadow AI is any AI tool used for work without review or approval. It carries two risks. Data pasted into an unreviewed tool goes to a vendor whose retention and training terms nobody has read. And some tools connect to company systems with standing access to mailboxes, calendars and files. Governance frameworks assume you know what you run: the NIST AI Risk Management Framework expects that mechanisms are in place to inventory AI systems (GOVERN 1.6). This is general information, not legal advice.
What counts as shadow AI
A useful inventory covers more than chatbots:
- Personal or free-tier accounts of chat assistants used with work content.
- Browser extensions that read page content to summarize, rewrite or autofill.
- Meeting notetakers that join calls through calendar access and store recordings.
- Assistants connected to company email, chat or file storage through OAuth (the "Sign in with Google or Microsoft and allow access" flow).
- AI features inside approved software that a vendor enabled by default.
- Developer tools: coding assistants on personal licenses, and model API keys billed to a personal card and used in internal scripts.
Where shadow AI shows up: discovery sources compared
| Source | What it reveals | What it misses |
|---|---|---|
| OAuth and app consent grants | Tools connected to company accounts, with the access they hold | Tools used without a company sign-in |
| SSO and sign-in logs | Which company-identity apps people actually use | Personal accounts |
| DNS, proxy or firewall logs | Traffic to AI services from company networks and managed devices | Personal phones, home networks without VPN |
| Endpoint and browser management | Installed extensions and desktop apps | Unmanaged devices |
| Expense and card statements | Paid subscriptions and API usage | Free tiers |
| SaaS admin consoles | AI features enabled in tools you already license | Anything outside those tools |
| Staff survey | Personal accounts, free tools, actual use cases | What people forget or don't mention |
Start with OAuth grants, expenses and admin consoles, which you can usually query in a day.
How to find shadow AI in OAuth grants
OAuth grants deserve the first look, because a connected tool keeps its access after the user closes the browser tab. A notetaker with calendar access can join every meeting on that calendar. An email assistant with mailbox read access can read every message.
In Google Workspace, the Admin console lists apps that have accessed Google data, with the number of users and the OAuth scopes each app requests, and you can download the list as CSV. Google notes the list updates 48 hours after a token is granted or revoked, so very recent grants may be missing.
In Microsoft Entra ID, each enterprise application has a Permissions page with an Admin consent tab and a User consent tab. The User consent tab shows what individual users granted. Microsoft documents how to review and revoke these permissions and notes that revoking a grant doesn't stop a user from consenting again.
Sort the export by scope, then by name. Read access to all mail, all files or all calendars is what makes a tool a priority, whatever it's called. Tools that can also send or modify data carry more risk again; our post on securing AI agents that can use tools covers how to scope that access.
Checking network, DNS and endpoint data
DNS and proxy logs show which AI services managed devices reach. List the domains for the AI products you know about, then count distinct devices per domain over 30 days. Device counts are enough at this stage.
Browser management or mobile device management (MDM) tools can report installed extensions. Filter for extensions that can read and change data on all websites, then check which of those advertise AI features.
Two limits apply. These sources only see managed devices and company networks, so a phone on mobile data is invisible. And in several EU countries, monitoring employee activity can require consultation with a works council or a data protection review. Check with HR and counsel first, and tell staff what you're collecting and why.
Expense reports and AI features you already pay for
Ask finance for a year of card and expense lines from AI vendors, including small monthly charges and usage-based API billing. An expensed subscription on a personal card is a paid tool with no contract review behind it.
Then open the admin console of each major system: email, documents, chat, CRM, support desk. Vendors have added AI assistants to these products, and some arrive enabled. Record whether each feature is on, who can use it and which data it can reach. These findings are the easiest to act on, because you already have a contract with the vendor.
A staff survey that gets honest answers
Logs find tools. A survey finds use cases, which is what you need to decide what to approve. Keep it anonymous, short and explicitly free of consequences for past use. Ask:
- Which AI tools do you use for work, including free ones and ones on your phone?
- What do you use each one for?
- What kind of information do you put into it?
- Is it a personal or company account?
- Which tool would you most want approved?
The last answer shows where demand is. Approving one reviewed tool for that need removes the reason to use five unreviewed ones.
What to do with each tool you find
Triage every finding into one of four outcomes:
| Outcome | When it fits | Next step |
|---|---|---|
| Approve | Acceptable data terms, company account available, real business need | Add to the approved list; move users to company accounts |
| Restrict | Useful, but only safe for some data or teams | Approve with limits on data, teams or features |
| Replace | Real need, but unacceptable terms or access | Offer an approved alternative, then remove it |
| Block | Excessive access, unacceptable terms or no business need | Revoke grants, block at the identity provider, explain why |
For each approved or restricted tool, record the owner, purpose, data categories, account type, whether the vendor trains on your data and how long it keeps it. That record is your AI inventory, and the starting point for the risk classification in our EU AI Act guide for SMBs.
Common mistakes when looking for shadow AI
- Treating discovery as enforcement. If the first visible result is blocked tools and warnings, survey answers dry up and use moves to personal devices.
- Blocking before offering an alternative. Users switch to another, less visible tool.
- Reviewing OAuth grants by vendor name and missing the broad scopes.
- Skipping AI features inside approved software, which can reach more company data than any standalone tool.
- Collecting individual browsing data when device counts would answer the question. It adds privacy risk without improving decisions.
Keeping the AI inventory current
Discovery is a recurring job. Three controls keep each round small:
- Route new tools through a request process. A fast, predictable approval route, defined in your company AI use policy, gives people a reason to ask first.
- Require admin approval for new OAuth grants. Google Workspace and Microsoft Entra both let admins control which apps users can connect, and Google lists apps users have requested under "Apps pending review."
- Rerun the sources quarterly. Export OAuth grants, pull AI vendor expense lines, check admin consoles for newly enabled features and compare with last quarter.
If you want an outside view, our AI Readiness & Governance Assessment includes an inventory of AI tools in use, including unofficial shadow AI, along with a risk register and policy recommendations.
Frequently asked questions
Is shadow AI illegal?
Using an unapproved tool is usually a policy issue. It can become a legal one when personal data goes to a vendor without a lawful basis or a processing agreement, which can breach GDPR. Ask counsel how this applies to the tools you find.
Can we just block all AI tools?
You can block known domains on managed devices, but that won't reach personal phones or home networks, and it pushes use out of sight. Blocking works better as a targeted step for specific tools, alongside an approved option for the same need.
How long does a first shadow AI inventory take?
It depends on how many systems you run and who holds admin access. OAuth exports, expense lines and admin console checks are fast. Network analysis and the survey take longer because they need scoping and a response window.
Who should own the AI inventory?
One named owner, usually in IT, security or operations, with input from legal and finance. The owner keeps the record current and runs the quarterly review.