Shadow AI Governance Checklist

Four questions to run before you write a policy — you can do this in an afternoon

Question 1 What AI tools are people actually using?

Ask each team directly — not "what's approved," but what are they actually running today
Include personal accounts (ChatGPT, Claude, Gemini) used for work tasks
Include tools embedded in other software (Copilot in Word, AI features in your CRM)
Record every tool named — don't filter or judge at this stage

Question 2 What data are they putting into those tools?

For each tool identified, ask: what kind of information goes in?
Flag immediately: customer names, emails, financial data, employee records, contract terms, strategy documents
Confirm whether personal information (as defined under PIPEDA) is being processed
Note whether data is going to tools with Canadian data residency or US-based servers

Question 3 Who owns the decision about whether that's acceptable?

Name one person — not a committee — who can say yes or no on each tool and data type
Confirm that person has the information they need to make that call
If no one currently owns this decision, name who should — and get their agreement today
Document the decision owner by tool category (not one-off, per tool)

Question 4 What is the one next decision we need to make?

Based on what you found: which tool or data type is the highest-risk item?
Make one concrete decision on that item before this meeting ends (approve it, restrict it, or escalate it)
Set a date to revisit the rest — don't let the full list become a parking lot
Communicate what was decided and why to the people affected — don't govern silently

After What to do with what you find

Tools with no personal data and no compliance exposure: document them as approved
Tools processing personal data: review vendor data processing terms and update your privacy policy
Tools you can't get clarity on: restrict use until the decision owner has reviewed
Next step: write a one-page acceptable use policy so people know what's allowed going forward