1. Do you have a written list of approved AI tools?

Yes No / Not sure

You can't police what you haven't defined.

2. Can employees access AI tools via company SSO?

Yes No / Not sure

SSO visibility = shadow-AI detection.

3. Are browser AI extensions restricted via MDM?

Yes No / Not sure

Browser extensions are the #1 shadow AI vector.

4. Is there a policy on pasting customer data into AI?

Yes No / Not sure

Most data leaks happen via paste.

5. Are employees trained on AI acceptable use?

Yes No / Not sure

Training reduces incidents 50%+.

6. Do AI integrations use least-privilege scoped keys?

Yes No / Not sure

An AI agent shouldn't have DBA access.

7. Is spend on AI platforms reviewed monthly?

Yes No / Not sure

Unexpected AI bills = shadow usage.

8. Is there a logging-or-block policy for unapproved AI URLs?

Yes No / Not sure

Network-level signals reveal shadow AI fastest.

9. Have you surveyed employees about AI tool usage recently?

Yes No / Not sure

People know what they use — ask them.

10. Are AI outputs reviewed before customer-facing publication?

Yes No / Not sure

Prevents hallucinated claims from shipping.

Shadow AI Detector