AI governance, put to work.
Document AI use in support, knowledge work and customer delivery, with named reviewers and practical handover records.
Use the kits to record the answers and keep the next steps clear.
Free field guide · Before a customer ticket goes into an AI assistant
Start with a free tool: Shadow AI Check · Policy Starter · Readiness check · Questionnaire Starter · Help me choose
Here’s one record from Harbor IT Services’ fictional Toolkit: the use is disclosed, the evidence is attached, the decision states its reason, and the follow-up has an owner and a date. The leadership report is built from the same record.
See the full sample reportFictional example. Review your own report before sharing.
01 Disclosure
02 Evidence
03 Decision with a reason
04 Follow-up
Example of a gap the kit flags
No vendor assessment or reason recorded
Next action: attach the vendor assessment, or record why the use is approved without one, before relying on this approval. Owner: Service delivery manager.
Also open: A sample troubleshooting instruction has not been tested. Owner: Service delivery manager, due Oct 22, 2026.
Harbor IT Services is a fictional managed IT provider. Here is one round with the Shadow AI Risk Kit, from the first responses to the follow-up.
01 Disclosure round
The kit’s staff survey goes to four groups. Each group gets a coverage record.
| Coverage ID | Team or source | Invited | Received | Coverage | Missing information and reason |
|---|---|---|---|---|---|
| C-1 | Service desk | 12 | 12 | Reviewed | All responses reviewed with the team lead. |
| C-2 | Engineering | 8 | 8 | Reviewed | All responses reviewed. |
| C-3 | Projects | 5 | 0 | Not started | No responses after one week. Reminder sent October 15, 2026. |
| C-4 | Contractors | 4 | 2 | Partial | Two contractors have not confirmed their tools or connector permissions. |
The Projects team has not responded. It stays in the record as Not started, with the reason.
02 An uncertain tool use
03 An accountable owner
The service operations lead owns the disclosure round and the review. The service delivery manager owns decisions about tools that touch tickets.
04 A review decision with a reason
05 The action handover, into the existing tracker
The Actions list exports as CSV. The service desk imports it into the ticket tracker it already uses, and each task keeps its action ID so the next review can match tracker status to the record.
Action ID,Related use ID,Action and completion evidence needed,Owner,Due date,Status
A-4,U-4,Identify the extension and account; record them in U-4,Service delivery manager,2026-10-23,Planned
A-5,,Collect the Projects team responses; update C-3,Service operations lead,2026-10-22,In progress
A-6,U-4,Remind the service desk: no ticket text in extensions until A-4 closes,Service delivery manager,2026-10-17,Completed06 Unresolved coverage stays visible
The report’s Coverage & gaps page lists Projects (0 of 5) and Contractors (2 of 4) with their reasons, so nobody reads the review as complete. They stay open until the responses arrive.
Fictional records. The kit records what people disclose and what you review. It does not scan devices or monitor staff.
| Recurring task | With this kit | With a basic spreadsheet |
|---|---|---|
| Chasing teams that have not responded | Each team’s coverage record shows people invited, responses received and the reason anything is missing. The report keeps the gap in view. | Who replied lives in another tab or an inbox, and the gap disappears from the summary. |
| The quarterly review | Every use has an owner and a next review date, so the review starts from the same record. | Owners and dates drift across copies, and the list is rebuilt each quarter. |
| A decision someone questions later | Each decision keeps its reason, conditions, owner and date next to the use. | A cell says Approved. The reason is in an email thread. |
| The leadership report | The report is generated from the same record: uses, risks, coverage gaps and the action handover. | Someone writes the summary by hand, each time. |
Actions export as CSV for the tracker your team already uses. The kit records what people disclose and what you review. It does not scan devices or monitor staff.
Each kit includes a guided dashboard, editable materials and a worked example.
Gather staff disclosures and build a tool inventory, then assign follow-up actions for unknown uses.
Shadow AI Risk Kit · IT Services edition
Adapt the policy, record approval and give staff a clear briefing and acknowledgment process.
AI Policy & Rollout Kit · IT Services edition
Record uses, owners, decisions and open actions in one dashboard. Export a leadership report for review.
AI Governance Toolkit · IT Services edition
Prepare answers with evidence references and reviewer decisions, keeping unresolved claims visible.
AI Questionnaire Response Kit · IT Services edition
Need discovery, a policy and customer answers together? AI Readiness Bundle · $649 · Save $198
Need discovery, a policy and a record of AI decisions together? AI Foundation Bundle · $599 · Save $148
Need all four, including customer answers? AI Management Bundle · $849 · Save $297
Downloadable tools for desktop browsers. A blank workspace for your own records, editable materials and a completed example. One company. One-time purchase.
Examples cover organizational decisions and records. The kit does not inspect tenants, scan endpoints or implement technical controls. Each client company needs its own license.
Preparing for ISO 42001 or Microsoft SSPA?