Shadow AI and AI Sprawl Governance Maturity Assessment
A 25-question diagnostic across 5 domains that tests whether an organization can govern the AI tools its people actually use: acceptable use policy, discovery and visibility, data leakage protection, procurement and vend...
Overview
A 25-question diagnostic across 5 domains that tests whether an organization can govern the AI tools its people actually use: acceptable use policy, discovery and visibility, data leakage protection, procurement and vendor risk, and spend, value and enablement. Written for the CIO, CISO or IT governance lead who needs to answer: do we know which AI tools our people use, and are we governing them or flying blind?
Detailed Description
Shadow AI is one of the fastest-growing unmanaged risks in enterprise technology. Employees adopt chat assistants, coding assistants, browser extensions and niche AI services faster than governance can keep up. Most organizations do not know how many AI tools are in use, what data flows into them, who pays for what, or whether any of it meets regulatory requirements.
This assessment follows the order in which shadow AI governance has to be built. It starts with Policy and Acceptable Use, because discovery cannot sort tools into sanctioned, tolerated and prohibited until the policy defines those tiers. It then tests Discovery and Visibility (can you find what is out there), Data Leakage and Protection (is sensitive data leaving through AI tools), Procurement, Vendor Risk and Compliance (does every tool pass a real risk, contract and regulatory check), and Spend, Value and Enablement (where the money goes, whether it pays off, and whether people have approved tools good enough that they stop going around the rules).
Each question is scored on whether the capability is documented, implemented and effective, so the results separate governance that exists on paper from governance that works, and name Paper Tigers, Tribal Knowledge and Measurement Gaps. Every score comes with specific guidance on what to fix next. AI Spend Management, Data Loss Prevention Operations and AI Governance are companion models for deeper coverage of those areas.
Assessment Details
Audience
CIO / CISO / IT Governance Lead / Chief AI Officer. Secondary: data protection officers, procurement and vendor management, legal and compliance, IT finance.
Purpose
Shows whether AI tool adoption is governed or merely tolerated, exposes where data, money and risk escape through unsanctioned tools, and gives each gap a concrete next step and a measurable target.
Effort
Initial assessment: 60-90 minutes with the AI governance lead and a security representative, with input from procurement, legal and compliance. Evidence gathering: 1-2 weeks, including an inventory extract, a discovery report and a sample of vendor assessments. Reassessment: 45-60 minutes.
Cadence
Quarterly, because the AI tool landscape changes quickly, and within 30 days of a major AI tool rollout, a data exposure incident or a new AI regulation taking effect.
Framework Alignment
KPIs
- Shadow AI Ratio - Unsanctioned AI tools found in use versus sanctioned tools. Target: declining every quarter.
- Mean Time to Detect New Shadow AI - Calendar days from first use of a new unsanctioned AI tool to detection. Target: under 7 days.
- AI Data Exposure Incidents - Confirmed sensitive data exposures through AI tools per quarter. Target: zero, with near misses declining.
- Centralized AI Spend Coverage - Share of AI-related spending captured in the consolidated view. Target: 90% or more.
- Policy Recall Rate - Share of employees who correctly describe the AI acceptable use rules in spot checks. Target: 80% or more.
Dependencies
Assessment Outline
(5 domains · 25 questions)-
1
1 Policy and Acceptable Use
Acceptable use policy, data rules for AI, personal versus corporate accounts, policy communication and acknowledgment, AI literacy and safe use training
- 1.1 AI Acceptable Use Standard 1 questions
- 1.2 Data Rules for AI 1 questions
- 1.3 Personal vs. Corporate AI Accounts 1 questions
- 1.4 Policy Communication and Acknowledgment 1 questions
- 1.5 AI Literacy and Safe Use Training 1 questions
-
2
2 Discovery and Visibility
AI tool inventory, automated discovery, risk-based classification and tiering, usage telemetry, detection speed for new tools
- 2.1 AI Tool Inventory 1 questions
- 2.2 Automated Discovery 1 questions
- 2.3 Classification and Tiering 1 questions
- 2.4 Usage Telemetry 1 questions
- 2.5 New Tool Detection Speed 1 questions
-
3
3 Data Leakage and Protection
Data loss prevention for AI data paths, prompt content monitoring, vendor data handling review, output governance, AI data exposure incident response
- 3.1 DLP for AI Endpoints 1 questions
- 3.2 Prompt Content Monitoring 1 questions
- 3.3 AI Vendor Data Handling Review 1 questions
- 3.4 Output Governance and Hallucination Risk 1 questions
- 3.5 AI Data Exposure Incident Response 1 questions
-
4
4 Procurement, Vendor Risk and Compliance
Centralized procurement, vendor risk assessment, regulatory and data residency checks, contract terms review, AI-specific risk register
- 4.1 Centralized AI Procurement 1 questions
- 4.2 AI Vendor Risk Assessment 1 questions
- 4.3 Regulatory and Data Residency Compliance 1 questions
- 4.4 Terms of Service and Contractual Governance 1 questions
- 4.5 AI-Specific Risk Register 1 questions
-
5
5 Spend, Value and Enablement
Consolidated AI spend, license utilization, value tracking, approved toolset, shadow-to-sanctioned fast track
- 5.1 AI Spend Visibility 1 questions
- 5.2 License Utilization and Rationalization 1 questions
- 5.3 AI ROI and Value Tracking 1 questions
- 5.4 Approved AI Toolset 1 questions
- 5.5 Shadow-to-Sanctioned Fast Track 1 questions
At a Glance
Still have questions? Get in touch
Business Bay, Dubai, UAE
ITSGovernance