Shadow AI Risk Kit · Prepared by Fictional Operations manager
7 of 7 sections reviewed by the preparer. Review marks describe the entries, not whether controls are operating.
18 employees; 3 temporary warehouse staff
First bounded Shadow AI assessment
Showing 3 of 4 open actions. Showing 3 of 8 section notes. The Full record export preserves complete notes, entries and review coverage.
Confirm the scope and supporting evidence with the owners. Resolve or clearly disclose open conditions. Choose the full record when the recipient needs detailed answers or evidence locations.
Shadow AI Risk Kit · Prepared by Fictional Operations manager
The five reviewer priorities recorded so far, with the next action already in the register. This page is a briefing for leadership. Respondent names are omitted; review free-text notes and action owners before sharing.
| Risk | Priority | What we are doing |
|---|---|---|
| Autonomous mailbox sending can send customer information immediately | Urgent | Complete the incident scope review and decide with the owners whether customers must be told · Operations manager |
| Edited product photos may break a supplier’s image terms | Priority | Get written confirmation of the supplier’s image terms · Sales and marketing lead |
| Call recording could expose customer and supplier price discussions | Priority | Pause the recorder and review retention and deletion options without destroying incident evidence · Sales manager |
| Unknown spreadsheet fields may include customer personal information | Investigate | Obtain redacted export file details and account information · Warehouse supervisor |
| Public-source research can contain wrong facts | Routine | No action recorded · Owner needed |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
Urgent and Priority records appear first; reviewer judgments are not automated. Showing 1–5 of 5 records. Long cells are excerpts; full wording is in the internal working record.
| Use / scenario | Priority | Owner |
|---|---|---|
| U7 · Autonomous mailbox sending can send customer information immediately | Urgent | Operations manager |
| U3 · Edited product photos may break a supplier’s image terms | Priority | Operations manager |
| U2 · Call recording could expose customer and supplier price discussions | Priority | Operations manager |
| U4 · Unknown spreadsheet fields may include customer personal information | Investigate | Operations manager |
| U6 · Public-source research can contain wrong facts | Routine | Operations manager |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
7 recorded uses; 3 record-supported. Groups with missing information appear first. Counts do not establish complete discovery. Showing 1–5 of 5 records. Long cells are excerpts; full wording is in the internal working record.
| Team / source | Responses / coverage | Open gap |
|---|---|---|
| Sales | 8 of 8 / Reviewed | No survey nonresponders; no device inventory supplied. |
| Purchasing | 5 of 5 / Reviewed | Only self-disclosure and manager interview. |
| Warehouse | 4 of 5 / Partial | One absent driver; connected apps still being checked. |
| Operations | 4 of 4 / Reviewed | Paid subscriptions checked; free and personal tools are outside expense records. |
| Temporary staff | 2 of 6 / Partial | Three nonresponses. Do not extrapolate two responses to all temporary staff. |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
Each record is one reported AI use. File imports and source approval claims do not grant approval. Review permissions and conditions in the full record. Showing 1–5 of 7 records. Long cells are excerpts; full wording is in the internal working record.
| Tool / use | Purpose / information | Owner / status |
|---|---|---|
| U1 · DraftDesk | Draft catalog descriptions from supplier specifications · Published supplier specifications only | Sales and marketing lead / Approved |
| U2 · MeetingNote | Summarize customer calls · Customer discussion, participant names and audio | Sales manager / Unapproved |
| U3 · PixelForge | Clean up product photos for the catalog · Supplier product photos not yet released | Sales and marketing lead / Restricted |
| U4 · SheetPilot | Spreadsheet summaries · Customer order exports; fields not established | Warehouse supervisor / Unknown |
| U5 · CodeHelper | Spreadsheet formulas for the stock report · Public examples and synthetic test data | Operations manager / Approved |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
Each record is one reported AI use. File imports and source approval claims do not grant approval. Review permissions and conditions in the full record. Showing 6–7 of 7 records. Long cells are excerpts; full wording is in the internal working record.
| Tool / use | Purpose / information | Owner / status |
|---|---|---|
| U6 · SearchBrief | Supplier background research · Public sources only | Purchasing lead / Restricted |
| U7 · AutoReach agent | Draft and send customer follow-ups · Mailbox content and customer contacts | Sales manager / Unapproved |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
4 open actions. Open actions first, then earliest recorded due date. Completed entries remain visible. Showing 1–5 of 6 records. Long cells are excerpts; full wording is in the internal working record.
| Next action | Owner | Due / status |
|---|---|---|
| Pause the recorder and review retention and deletion options without destroying incident evidence | Sales manager | 2026-10-20 / In progress |
| Complete the incident scope review and decide with the owners whether customers must be told | Operations manager | 2026-10-20 / In progress |
| Obtain redacted export file details and account information | Warehouse supervisor | 2026-10-21 / Blocked |
| Get written confirmation of the supplier’s image terms | Sales and marketing lead | 2026-10-23 / In progress |
| File the approved workspace settings snapshot | Operations manager | 2026-10-05 / Completed |
Shadow AI Risk Kit · Prepared by Fictional Operations manager
4 open actions. Open actions first, then earliest recorded due date. Completed entries remain visible. Showing 6–6 of 6 records. Long cells are excerpts; full wording is in the internal working record.
| Next action | Owner | Due / status |
|---|---|---|
| Revoke mail sending and drive connections; attach access log and incident reference | Operations manager | 2026-10-05 / Completed |