Shadow AI Health Check. Find out where AI is already in your business. In a recent blog I wrote about the hidden risk of “shadow AI” in small businesses.
I was surprised by the numbers who got back in touch wanting to know more about:
- Owners and managers recognised the patterns.
- Staff using ChatGPT on personal accounts.
- Documents and emails pasted into prompts.
- Little or no visibility at leadership level.
The next question was always the same.
“How do I know where this is happening in my business?”
That is why I have created a Shadow AI Health Check, designed for SME owners and others who sit in a similar position.
What do I mean by shadow AI?
Shadow AI is AI use that sits outside any agreed process.
This might include:
• Staff signing up to AI tools with personal email
• People using public versions of ChatGPT for client work
• Files, emails and HR notes entering prompts with no guidance
• No written policy, no DPIAs, no clear ownership
Often this starts with good intent. People want to save time or handle a busy workload. The risk appears later, when clients, regulators or insurers start asking hard questions.
From concern to clarity
Many owners I speak to feel stuck. They know AI is in the building. They want the benefits but have limited time to investigate tools and risks.
What they need first is a clear picture.
The Shadow AI Health Check does that by asking structured questions in five areas:
• Visibility. How well you understand which AI tools people use and where.
• Data. Where customer, client and HR information enters AI tools.
• ChatGPT use. How staff handle data controls and what they believe about “sharing”.
• Security. Where prompts and files are stored and how staff log in.
• Governance. Strategy, policy, DPIAs and training.
You answer each question with A, B or C. A scores 0, B scores 1, C scores 2. At the end you add up your score and see where you sit on the scale from “low visible risk” through to “high shadow AI exposure”.
Online and PDF versions
The health check is available in two formats.
There is an online version that you complete on screen. It takes around 20 to 30 minutes and is ideal if you want a quick view on your own.
There is also a downloadable PDF version that mirrors the online questions. This works well if you prefer to print the guide, capture handwritten notes, or bring it into a leadership or board meeting.
You will find both versions on the Shadow AI Health Check page on my website:
Shadow AI Health Check
What you learn from your score
The score itself is only part of the story. The questions you answer with C are often more important than the total.
They highlight patterns such as:
• Regular use of live customer data in public AI tools
• Widespread use of personal ChatGPT accounts for work
• Little or no awareness of data controls
• No DPIAs for high risk AI uses such as recruitment or profiling
These answers show you where risk sits highest, even if your overall score looks moderate.
How this links to an AI strategy
The health check does not tell you to ban AI. That would be a lost opportunity.
Instead, it gives you a starting point for a practical AI strategy.
After you complete it, you will have:
• A clearer view of where AI already appears in your business
• Examples from your own teams and workflows
• A sense of which areas feel most exposed
From there, we can start to define:
• Where AI helps you work smarter
• Where you need firm red lines around data and tools
• Simple rules and training that help staff stay safe and productive
Think of it as moving from background noise to a structured plan.
How to get started
If you recognise shadow AI in your own business and want a simple way to assess it, I would encourage you to try the Shadow AI Health Check.
You will find the online questionnaire and the PDF download on my website at:
Shadow AI Health Check
Once you have your score, and a few notes about where AI appears in your workflows, we can talk about next steps.
If you would like help turning your results into a practical AI strategy, you can contact me through the site and we can set up a short conversation. Sometimes that is all it takes to move from uncertainty to a plan that fits your business.
