AI Compliance · 2026-07-30 · 10 min read
Shadow AI Discovery: How to Find AI Tools Employees Use
Every unknown AI tool in your company is an unclassified legal duty and an unreviewed data flow. This guide compares five discovery methods honestly — surveys, expense reports, OAuth scans, SDK scans, browser monitoring — and lays out the triage loop that turns findings into policy.
Shadow AI is any AI tool, model, or AI-powered feature that employees use for work without approval from IT, security, or compliance — free chatbot accounts, browser extensions, AI features switched on inside approved SaaS, and model APIs added by developers. It breaks compliance because every unknown tool carries regulatory duties nobody has classified and data flows nobody has reviewed.
What counts as shadow AI?
Shadow AI is the AI-specific version of shadow IT, and it spreads faster, for three reasons. Most AI tools have a free tier, so there is no purchase order or invoice to catch. Many arrive as features inside software you already approved — your CRM, your meeting tool, and your help desk have all quietly added assistants. And the people adopting them are usually trying to do their jobs better, not trying to evade policy.
In practice, shadow AI shows up in four forms:
- Standalone tools. An employee signs up for a chatbot, transcription service, or image generator with a work email — or worse, a personal one.
- Workspace integrations. An AI notetaker or writing assistant is granted OAuth access to company email, calendars, and files.
- Embedded features. An AI capability gets switched on inside SaaS you already licensed, with no new signup at all.
- Developer usage. Engineers add AI SDKs or model API calls to internal tools or to the product itself.
That last category deserves special attention. Under the EU AI Act, building a customer-facing feature on a model API (OpenAI, Anthropic) typically makes your company the provider of that downstream feature, with the obligations that follow — the model vendor holds the general-purpose AI duties, not yours. An engineer's quiet integration can change your regulatory role without compliance ever hearing about it.
Why shadow AI breaks compliance
Two failure mechanisms compound here.
Unknown tools mean unclassified legal duties
AI regulation attaches duties to specific systems and specific uses. You cannot classify, disclose, audit, or train people on a system you do not know exists:
- EU AI Act Article 50 transparency obligations — disclosing AI interaction, marking AI-generated content, deep-fake disclosure — apply from 2 August 2026, and the general penalty regime of up to €15M or 3% of worldwide turnover applies from the same date. A support team that quietly deployed an AI chat widget has created an undisclosed Article 50 duty.
- EU AI Act Article 4, in force since 2 February 2025, requires both providers and deployers to ensure staff AI literacy. You cannot train staff on tools you do not know they use.
- Illinois HB 3773 (775 ILCS 5/2-102(L)), in force since 1 January 2026, turns AI in employment decisions into civil-rights exposure with a notice duty to employees. A recruiter running résumés through an unapproved AI screener creates that exposure on day one.
- NYC Local Law 144, in force since 1 January 2023, requires an annual independent bias audit and candidate notice for automated employment decision tools — and the employer owns the duty even when the tool belongs to a vendor ATS. Audit and posting failures accrue penalties per day.
- Maine 10 M.R.S. §1500-DD, in force since 16 September 2025, requires clear disclosure whenever a reasonable consumer could be misled into thinking they are chatting with a human — with penalties up to $10,000 per intentional violation under Maine's UTPA.
- Texas TRAIGA (HB 149, Bus. & Com. Code chs. 551–552), in force since 1 January 2026, imposes intent-based prohibitions with penalties from $10,000–$12,000 for curable violations up to $80,000–$200,000 for uncurable ones.
None of these laws asks whether your compliance team approved the tool. They ask whether the tool was used. If you are not sure which of the EU duties reach your company at all, the free EU AI Act checker maps your risk tier and role-scoped obligations in about three minutes.
Unknown tools mean uncontrolled data flows
The second failure is simpler: employees paste customer records, source code, contracts, and health information into free-tier tools whose default terms may allow training on user inputs. Whether a given vendor trains on your data by default is usually discoverable from its own published terms — but nobody manually checks thirty vendors' pages, and the defaults change. This is exactly the homework a structured vendor risk assessment exists to do, and it can only start after the tool is discovered.
How to find AI tools employees use: 5 discovery methods compared
No single method finds everything. The honest comparison:
| Method | What it catches | What it misses | Effort | Privacy cost |
|---|---|---|---|---|
| Employee surveys | Tools people remember, recognize as AI, and admit to | Everything else — usually the majority | Low | None |
| Expense report review | Paid subscriptions and seat licenses | Free tiers, where most shadow AI lives | Low | None |
| OAuth / workspace app scans | Every third-party app granted access to Google Workspace or Microsoft 365, plus the scopes it holds | Tools used with personal accounts and no workspace connection | Low | Low (read-only metadata) |
| Dependency manifest (SDK) scans | AI SDKs and model APIs in your codebase — the AI you actually ship | All non-engineering usage | Low–medium | None |
| Browser / endpoint monitoring | Nearly everything done in a browser | Very little — that is the problem | High | High — it is employee surveillance |
Employee surveys: a signal, not an inventory
Surveys are the weakest method and the most common first move. People forget tools, do not recognize embedded AI features as AI, and underreport anything they suspect is against the rules. Use a survey to launch the program with an explicit amnesty message — "tell us what you use, nothing bad happens" — but never treat the responses as your inventory.
Expense reports: paid tools only
Scanning expense lines and card statements for AI vendors catches paid subscriptions reliably and takes an afternoon. Its blind spot is structural: the majority of shadow AI runs on free tiers that never touch the finance system. Worth doing; never sufficient.
OAuth-grant and workspace app scans: the best first move
A read-only query against your Google Workspace or Microsoft 365 admin APIs lists every third-party app your employees have connected, along with the exact scopes each one holds — mail read, calendar read, file access. This is the highest-yield, lowest-friction method: it produces a day-one inventory without touching anyone's screen, and the scope data doubles as an instant risk signal (a notetaker with full mailbox access is a different conversation than a grammar checker). Shieldra runs this scan and matches results against 284 known AI tools, backed by a 40-profile verified vendor catalog of trains-on-your-data defaults — see features for how discovery and triage fit together.
Dependency manifest scans: find the AI you ship
Scanning dependency manifests — package.json, requirements.txt, go.mod — for AI SDKs surfaces the shadow AI that carries the heaviest duties: the AI in your own product. This matters for role classification under the EU AI Act (an API integration can make you a provider) and under state law. California AB 2013 (Civ. Code §§3110–3111), in force since 1 January 2026 with no size threshold, requires developers — expressly including fine-tuners, since §3110(d) defines substantial modification to include fine-tuning — to publish a 12-element training-data summary before public availability to Californians, enforceable under UCL §17200 at up to $2,500 per violation with no cure period. A fine-tuning script sitting in a repo can create a publication duty nobody in legal has heard of.
Browser monitoring: complete, invasive, and deliberately skipped
Endpoint agents and browser extensions that log every site employees visit are the most complete discovery method — and the least proportionate. They are surveillance, they poison the trust a disclosure program depends on, and in European workplaces they collide with works-council and data-protection expectations. Shieldra deliberately does not do browser monitoring: if your discovery program requires spying on employees, it has already failed at the culture layer.
The shadow AI triage loop: found → in review → decided → policy
Discovery without a follow-up process just produces a scarier spreadsheet. Run every discovered tool through the same four-step loop:
- Found. Every discovered tool lands in a single inventory with its source (OAuth scan, expense line, survey), its users, and any granted scopes. No judgment at this stage — if discovery triggers punishment, voluntary disclosure dries up permanently.
- In review. Assign an owner and answer three questions: what data can flow into the tool, does the vendor train on inputs by default, and which legal duties attach to this use (chatbot disclosure, employment-decision rules, EU AI Act transparency). A standard set of vendor questions keeps reviews consistent and fast.
- Approve or block. Approvals come with conditions: permitted data classes, required disclosures, a named business owner. Blocks come with a stated reason and an approved alternative — a block without an alternative does not stop the use case; it moves it to personal devices.
- Update the policy appendix. The approved and blocked lists should live as an appendix to your AI acceptable use policy, so the policy itself stays stable while the lists change weekly. Publish the change and record the decision.
Then loop. Inventories decay — re-run workspace scans at least monthly and manifest scans on every release cycle, routing anything new back to step one.
The uncomfortable truth about shadow AI
Shadow AI is not an employee-behavior problem; it is an inventory problem. The tools work, your people will keep using them, and the regulatory clock ran regardless — Article 4 literacy duties have been in force since 2 February 2025, Illinois and Texas obligations since 1 January 2026, and Article 50 transparency applies from 2 August 2026. The companies in trouble will not be the ones whose employees used AI. They will be the ones who never looked.
FAQ
What is the difference between shadow IT and shadow AI?
Shadow IT is any unapproved software; shadow AI is the AI-specific subset, and it is harder to catch. Free tiers bypass procurement, AI features appear inside already-approved SaaS without a new signup, and AI use triggers legal duties — disclosure, bias audits, transparency — that ordinary unapproved software does not.
Is it illegal for employees to use unapproved AI tools?
Using an unapproved tool is not itself illegal, but the use can silently put the company in breach of laws that apply regardless of approval status. Examples in force now include Illinois HB 3773 (AI in employment decisions, since 1 January 2026), NYC Local Law 144 (bias audits, in force since 1 January 2023), and Maine 10 M.R.S. §1500-DD (chatbot disclosure, since 16 September 2025), with EU AI Act Article 50 transparency applying from 2 August 2026.
How can I find AI tools employees use without monitoring their browsers?
Start with a read-only OAuth and workspace-app scan of Google Workspace or Microsoft 365 — it lists every connected third-party app and its access scopes without touching anyone's screen. Add expense-report review for paid tools and dependency-manifest scans for AI in your codebase. Together these three methods build a strong inventory with no employee surveillance.
Should we just block all AI tools at the firewall?
No. Blanket blocks push usage onto personal devices and personal accounts, where no scan can see it and no policy condition applies, leaving you with the same legal exposure and zero visibility. Approve-with-conditions plus a fast review lane for new requests consistently beats prohibition.
How often should we re-run AI discovery scans?
Monthly at minimum for OAuth and workspace-app scans, and on every release cycle for dependency-manifest scans, because new grants and new SDKs appear continuously. Treat discovery as a standing loop feeding your triage process, not an annual audit event.