Browse Fernhill Wholesale’s fictional records, then see the report they support. Nothing to fill in.
This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.
Named owners, clear next steps and visible gaps.
| Action | Next step | Owner | Due | Status |
|---|---|---|---|---|
| NOTE-1 | Bounded assessment completed; 21 invited people. No scanner or complete-discovery claim. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-2 | 17 of 21 responses. The sales manager and the warehouse supervisor must close four missing responses by October 20; three are temporary staff. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-3 | Seven disclosed workflows; three record-supported and four self-reported. Account approval is scoped, not a blanket vendor endorsement. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-4 | R5 is Urgent. Connector revocation is complete in the scenario; incident scope remains open. R2 and R4 are Priority. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-5 | Six decisions recorded. U6 remains restricted to public research under its existing manager instruction. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-6 | Operations manager: finish the U7 incident scope by October 20. Warehouse supervisor: temporary staff file details by October 21. Do not describe containment as resolution. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-7 | All references point to fictional source exhibits, not real customer records. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-8 | No upstream kit supplied records. CSV disclosures were imported directly into AI uses. | Confirm with section owner | Not yet recorded | Needs review |
Every name, record and outcome in this example is invented. Counts describe this working set; they are not a compliance score.
Open a working area to see the details behind the report.
Define one team or workflow. Record exclusions so the report never implies complete discovery.
List every intended team and evidence source, including sources not examined. Response counts describe participation, never discovery completeness.
Record a tool, account, data and use together. Include AI embedded in existing software and agents. Avoid putting confidential source content here.
Prioritize each actual use. Suggested flags explain follow-up; your reviewer makes the risk decision. Suspected active exposure belongs in your incident process.
Only record an approval after the authorized owner decides. An approved tool may still have restrictions on accounts, data and use.
Assign a concrete next step. Keep planned safeguards distinct from safeguards that already operate.
Index only records you are permitted to use. References are not attached files or independent verification.
Full source records retained for review when there is no direct destination. These are references, not verified controls or approved questionnaire answers.
A report for internal reviewers.
Shadow AI Risk Kit
This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.
18 employees and 3 temporary warehouse staff across five groups · Fictional completed working example; unresolved facts and actions remain visible.. This is a preparation record based on illustrative inputs, not an independent assessment.
| Action | Next step | Owner | Due | Status |
|---|---|---|---|---|
| NOTE-1 | Bounded assessment completed; 21 invited people. No scanner or complete-discovery claim. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-2 | 17 of 21 responses. The sales manager and the warehouse supervisor must close four missing responses by October 20; three are temporary staff. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-3 | Seven disclosed workflows; three record-supported and four self-reported. Account approval is scoped, not a blanket vendor endorsement. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-4 | R5 is Urgent. Connector revocation is complete in the scenario; incident scope remains open. R2 and R4 are Priority. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-5 | Six decisions recorded. U6 remains restricted to public research under its existing manager instruction. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-6 | Operations manager: finish the U7 incident scope by October 20. Warehouse supervisor: temporary staff file details by October 21. Do not describe containment as resolution. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-7 | All references point to fictional source exhibits, not real customer records. | Confirm with section owner | Not yet recorded | Needs review |
| NOTE-8 | No upstream kit supplied records. CSV disclosures were imported directly into AI uses. | Confirm with section owner | Not yet recorded | Needs review |
0 of 0 indexed records are marked reviewed in this fictional example. Missing or unreviewed records remain explicit.
| ID | Record | Owner | Date | Status |
|---|
Confirm the scope, replace every fictional record with your own, review the supporting evidence, and approve the final wording. Completed records can inform decisions; they do not establish certification or compliance.