Shadow AI is AI used in an organisation without formal oversight or approval. It includes AI features embedded in existing tools, assistants and generators staff adopt themselves, and vendor products that add AI after purchase. It is a governance problem because you cannot assess or control systems you do not know about.

Why does an AI inventory matter for the EU AI Act?

The EU AI Act is risk-based, so your obligations depend on classifying each AI system by its use and risk level. You cannot classify, document or oversee a system you have not identified, which makes a complete inventory the practical starting point for compliance.

How do we find the AI already in use?

Combine a staff survey, a review of SaaS and vendor contracts for AI features, and signals from expense and network data. Treat embedded AI as a system in its own right, and record who owns each one. A rough first inventory is far more useful than no inventory.

What is ISO/IEC 42001 and how does it help?

ISO/IEC 42001 is the international standard for an AI management system. It gives you a repeatable structure for inventory, classification, controls and oversight, much as ISO/IEC 27001 does for information security, and it is becoming a recognised way to show customers and regulators that your AI is governed.

Does this duplicate our GDPR and ISO 27001 work?

No. Most AI controls extend the information security, privacy and resilience work you already have. The aim is one management system that also covers AI, not a separate, parallel programme.

Can we fix this ourselves, or do we need help?

You can start the inventory and the intake gate internally. Classification against the EU AI Act and designing controls for higher-risk systems are where an independent, regulation-aware partner usually adds the most value. Nordic Cyber Group provides AI governance and compliance services for exactly this. Book a free consultation to talk it through.

Shadow AI and the Inventory Gap: The AI…

8 Min Read

The problem, in one sentence

Most organisations cannot produce an accurate list of the AI systems they are running. And you cannot govern, or prove compliance for, what you cannot see.

Picture the moment it bites. An auditor, a regulator or a large customer asks a simple question: which of your AI systems are high risk under the EU AI Act, and how are they controlled? The honest answer, in most organisations today, is that no one has a complete list to answer from. AI did not arrive through one big decision. It arrived through dozens of small ones: a feature switched on inside a tool you already pay for, a model a team wired into a workflow, a vendor that added AI to a product you bought years ago.

That blind spot has a name. Shadow AI is the AI in use across your organisation that never passed through any form of oversight. It is now the first obstacle to AI governance and compliance, because every policy, control and legal obligation that follows assumes one thing you may not have: a clear picture of what you are actually running.

How the gap opens

No one sets out to run ungoverned AI. It accumulates quietly, through ordinary work, and most of it never crosses the desk of anyone responsible for risk. AI enters through several doors at once:

Embedded vendor AI.Tools you already use add AI features in an update, from the office suite to the CRM and the helpdesk. You never bought AI, but you are now running it.
Tools staff adopt themselves.Individuals and teams sign up to assistants and generators to get work done, often on free tiers, usually without telling anyone in risk or security.
Quiet pilots and low-code builds.A proof of concept becomes load-bearing. A low-code automation with a model inside it ends up in a real process without ever being signed off.
Developer libraries and APIs.Engineering teams call model APIs and pull in open-source models as dependencies, the same way they add any other library.
Inherited systems.A merger, an acquisition or an outsourced service brings in AI you did not build and may not have documented at all.

Why a missing list becomes a legal problem

The EU AI Act is risk-based. Your obligations for any given system depend entirely on what that system does and how much risk it carries, which means the whole regime rests on being able to find and classify each one. ISO/IEC 42001, the international standard for an AI management system, starts in the same place: a known, owned inventory. To meet either, you are assumed to be able to do all of the following:

Identify every AI system and your role.Know what you are running, and whether you are its provider, deployer or distributor, because your duties change with the role.
Classify each system by risk.Place every use in the right tier, from prohibited through high risk to limited and minimal, so the right obligations attach.
Keep documentation and records.Hold the technical documentation, logs and evidence that show a system is managed, not just switched on.
Provide oversight and transparency.Give higher-risk systems meaningful human oversight, and tell people when they are interacting with AI where the rules require it.
Monitor systems once they are live.Watch for drift, errors and misuse after deployment, and act on what you find, because a one-off sign-off is not oversight.
Show the evidence on demand.Produce the register, the classifications and the records when an auditor, supervisor or customer asks, without a scramble.

A system you have not found fails all four by default. And the stakes are not trivial: penalties under the EU AI Act for the most serious breaches reach up to 35 million euros or 7 percent of global annual turnover, and customers and procurement teams are starting to ask for evidence of AI governance the way they already ask for ISO/IEC 27001.

What the gap is quietly costing you

The risk is not abstract. An inventory you do not have is usually hiding specific, live exposures:

A high-risk system no one is watching.A tool screening job applicants or scoring credit may be high risk under the EU AI Act, running without the oversight, testing or documentation the law expects.
Personal data with no lawful basis.Staff paste customer or employee data into a tool that trains on inputs, with no lawful basis, no assessment and no record. That is a GDPR problem as much as an AI one.
Decisions you cannot explain.A model shapes an outcome that affects a person, and you cannot show how it reached it or that a human could step in and override it.
Discovery at the worst possible time.The gap surfaces during an incident, a breach or an audit, when the cost of not knowing is highest and the time to fix it is shortest.

How to close the gap

The fix is not a single piece of software. It is a short, repeatable loop that turns an unknown estate into a governed one. Five steps, in order:

Find what you have.Build an inventory of AI systems, built and bought, by combining a staff survey, a review of SaaS and vendor contracts, and data from expenses and network traffic. Treat each embedded AI feature as a system in its own right.
Classify each by risk.Map every system to its use and to the EU AI Act risk tiers, so you can see at a glance which are prohibited, high risk, limited risk or minimal, and which carry personal data.
Put a gate on new AI.Add a short intake step so new AI, whether bought or built, is registered and risk-checked before it goes live. This is what stops the gap reopening the week after you close it.
Apply controls where risk is highest.For higher-risk systems, add what the law expects: human oversight, documentation and logging, data quality checks, transparency notices and security. Spend the effort where the risk actually is.
Assure and report.Keep the inventory current, audit against it, and report AI risk to the board alongside other risks. Align the loop to ISO/IEC 42001 so it holds up to outside scrutiny.

None of this requires boiling the ocean. The first pass can be rough. What matters is that the list exists, has a named owner, and is kept alive rather than filed and forgotten. A rough inventory you maintain beats a perfect one you build once.

What solved looks like

You will know the gap is closed when:

The board can answer the question.Someone can say, in a meeting, how many AI systems you run and how many are high risk, without a two-week fire drill.
Every system has an owner and a tier.Each AI system you build or buy is on a register, classified, and mapped to the obligations it triggers.
New AI cannot sneak in.New AI, bought or built, has to pass a short intake check before it goes live, so the gap does not reopen.
Evidence is ready on request.You can produce what an auditor, regulator or customer asks for without a scramble.
It reuses what you already have.AI governance builds on your ISO 27001, GDPR and resilience work rather than running as a separate programme.

Where to start

You can begin most of this yourself this quarter. Name an owner, circulate the survey, review your vendor contracts, and start the list. Momentum matters more than polish at this stage.

The harder parts are classification and controls: deciding which systems are genuinely high risk under the EU AI Act, and designing the oversight that higher-risk systems need. That is where an independent, regulation-aware view tends to pay for itself, partly to get the risk tiers right, and partly to keep the assessment honest about the vendors whose tools you are weighing up. This is the kind of work Nordic Cyber Group does with boards and compliance teams across the Nordics and the wider EU, through our AI governance and compliance practice, aligned to the EU AI Act and ISO/IEC 42001. If a conversation would help, you can book a free consultation.

Frequently asked questions

What is shadow AI?Shadow AI is AI used in an organisation without formal oversight or approval. It includes AI features embedded in existing tools, assistants and generators staff adopt themselves, and vendor products that add AI after purchase. It is a governance problem because you cannot assess or control systems you do not know about.
Why does an AI inventory matter for the EU AI Act?The EU AI Act is risk-based, so your obligations depend on classifying each AI system by its use and risk level. You cannot classify, document or oversee a system you have not identified, which makes a complete inventory the practical starting point for compliance.
How do we find the AI already in use?Combine a staff survey, a review of SaaS and vendor contracts for AI features, and signals from expense and network data. Treat embedded AI as a system in its own right, and record who owns each one. A rough first inventory is far more useful than no inventory.
What is ISO/IEC 42001 and how does it help?ISO/IEC 42001 is the international standard for an AI management system. It gives you a repeatable structure for inventory, classification, controls and oversight, much as ISO/IEC 27001 does for information security, and it is becoming a recognised way to show customers and regulators that your AI is governed.
Does this duplicate our GDPR and ISO 27001 work?No. Most AI controls extend the information security, privacy and resilience work you already have. The aim is one management system that also covers AI, not a separate, parallel programme.
Can we fix this ourselves, or do we need help?You can start the inventory and the intake gate internally. Classification against the EU AI Act and designing controls for higher-risk systems are where an independent, regulation-aware partner usually adds the most value. Nordic Cyber Group provides AI governance and compliance services for exactly this. Book a free consultation to talk it through.