Start with the unmet need
In this guide, Shadow AI means using AI tools or automations at work without the organization’s defined evaluation and oversight process. It may appear in a personal account, browser extension, spreadsheet, department-purchased service or AI feature embedded in another application.
Investigate the work people are trying to complete: interpreting a specification, classifying a receipt, consulting a contract or preparing a quote. An approved alternative must solve that task with suitable access and response time. The following is an implementation proposal; it does not assume Zild automatically detects external tools.
Inventory uses, not just vendors
NIST AI 600-1 GOVERN 1.6 recommends inventorying generative AI systems and considering data provenance, models and versions, access modes, known issues and human oversight responsibilities. It is a voluntary risk-management reference, not platform certification.
For each use, record process, department, owner, tool, corporate or personal account, data sources, permitted actions, people served, cost, dependencies, evaluation status and next review. Include AI embedded in other systems. One tool may support uses with different risks: summarizing a public manual is not equivalent to sending a client’s confidential drawings.
Combine discovery with departmental participation
Start with short interviews, contract and expense reviews and team declarations of existing uses. IT and security can supplement the map with authorized corporate records under the company’s defined purpose, access and retention rules. Do not request passwords, API keys or copies of personal conversations to populate the inventory.
Provide a simple channel to report an unevaluated use and request an alternative. Explain who sees collected data and how requests are handled. Separate tool discovery from incident investigation: a subscription does not establish data leakage, and a missing record does not establish absence of use.
Decide based on process data and actions
Use clear states: under evaluation, approved for a scope, conditionally approved, suspended and retired. Record the decision maker and rationale. Check which data leaves the company, where it is processed, retention, executable agent actions and failure ownership. Answers must come from the contract and actual service configuration.
Engineering example: a pilot may extract fields from a project revision for review, while publishing quantities remains with the responsible engineer. In procurement, invoice classification may prepare a record; approval and payment follow existing authority rules. Approving an AI vendor does not automatically approve all these actions.
Migrate one workflow with acceptance criteria
Choose a frequent use with an owner and available data. Prepare representative tests, including wrong documents, outdated revisions, unauthorized users, malicious attachment instructions and integration failures. Compare accuracy, cycle time, rework and cost per correct outcome before and after. Define what requires human review.
Zild can provide a shared foundation of agents and connectors administered through users, groups and permissions in Zild Admin. Validate these settings in the deployed environment. External-tool inventory and contract assessment remain organizational responsibilities. After acceptance, train the team, migrate authorized routines and review redundant subscriptions with their owners.
Measure coverage and quality without mistaking silence for control
Synthetic example: a company maps 20 uses, assesses 15 and approves 12 for defined scopes. Assessment coverage is 75%; five remain pending. If eight of the 12 approved uses have migrated, adoption within that set is 66.7%. This does not establish that 75% of all actual company usage is controlled: the inventory may be incomplete.
Also track approval time, ownerless uses, expired exceptions, incidents, quality and cost per process. Schedule reviews when the model, connector, data source or purpose changes. The CoE should maintain an improvement backlog for the approved alternative: if people still bypass the process, investigate access, performance and unmet tasks.
Technical reference
Organize the next adoption step
Gather this information to scope the work with Zild. During the conversation, we assess integrations, owners and how to measure outcomes.
- A priority process and a sponsor
- Teams, data and tools involved
- Quality, cost and accountability criteria
Describe the process in the form; samples and documents can be prepared later without confidential data.
The form opens with this guide’s title. You can edit everything before sending.