Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
0 of 7 sections reviewed by the preparer. Review marks describe the entries, not whether controls are operating.
24 employees and 4 contractors across service desk, engineering and operations
Your team is introducing AI into customer support and needs clear rules.
This report summarizes your records. The Full record export preserves complete notes, entries and review coverage.
Confirm the scope and supporting evidence with the owners. Resolve or clearly disclose open conditions. Choose the full record when the recipient needs detailed answers or evidence locations.
Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
The five reviewer priorities recorded so far, with the next action already in the register. This page is a briefing for leadership. Respondent names are omitted; review free-text notes and action owners before sharing.
| Risk | Priority | What we are doing |
|---|---|---|
| Ticket-field redaction and customer permission remain unverified | Priority | Ticket-field redaction and customer permission remain unverified. Customer owner and security lead confirm permitted fields and processing terms · Service delivery man… |
| A sample troubleshooting instruction has not been tested | Investigate | A sample troubleshooting instruction has not been tested. Service delivery manager checks technical steps and removes customer identifiers · Service delivery manager |
| Two contractors have not confirmed tools or connector permissions | Investigate | Two contractors have not confirmed tools or connector permissions. Engineer tests changes in an isolated environment; customer execution needs separate approval · Serv… |
Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
Urgent and Priority records appear first; reviewer judgments are not automated. Showing 1–3 of 3 records. Long cells are excerpts; full wording is in the internal working record.
| Use / scenario | Priority | Owner |
|---|---|---|
| U-2 · Ticket-field redaction and customer permission remain unverified | Priority | Service delivery manager |
| U-1 · A sample troubleshooting instruction has not been tested | Investigate | Service delivery manager |
| U-3 · Two contractors have not confirmed tools or connector permissions | Investigate | Service delivery manager |
Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
3 recorded uses; 0 record-supported. Groups with missing information appear first. Counts do not establish complete discovery. Showing 1–2 of 2 records. Long cells are excerpts; full wording is in the internal working record.
| Team / source | Responses / coverage | Open gap |
|---|---|---|
| Staff | 24 of 24 / Reviewed | Responses are disclosures, not technical verification. |
| Contractors and associates | 2 of 4 / Partial | Two contractors have not confirmed tools or connector permissions |
Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
Each record is one reported AI use. File imports and source approval claims do not grant approval. Review permissions and conditions in the full record. Showing 1–3 of 3 records. Long cells are excerpts; full wording is in the internal working record.
| Tool / use | Purpose / information | Owner / status |
|---|---|---|
| U-1 · SupportDraft | Draft internal support articles from public vendor documentation · Public documentation and synthetic support tickets | Service delivery manager / Restricted |
| U-2 · TicketNote | Summarize customer support tickets · None pending permission review | Service delivery manager / Unapproved |
| U-3 · CodeDraft | Suggest internal scripts using synthetic test cases · Synthetic configuration examples with no secrets | Service delivery manager / Restricted |
Shadow AI Risk Kit — IT Services edition · Prepared by Service operations lead
3 open actions. Open actions first, then earliest recorded due date. Completed entries remain visible. Showing 1–3 of 3 records. Long cells are excerpts; full wording is in the internal working record.
| Next action | Owner | Due / status |
|---|---|---|
| A sample troubleshooting instruction has not been tested. Service delivery manager checks technical steps and removes customer identifiers | Service delivery manager | 2026-10-22 / In progress |
| Ticket-field redaction and customer permission remain unverified. Customer owner and security lead confirm permitted fields and processing terms | Service delivery manager | 2026-10-22 / Blocked |
| Two contractors have not confirmed tools or connector permissions. Engineer tests changes in an isolated environment; customer execution needs separate approval | Service delivery manager | 2026-10-22 / In progress |