Shadow AI is not one product category. It includes unsanctioned assistants, embedded AI features, developer experiments, external models, connected agents and approved systems whose purpose or permissions have changed. A questionnaire alone will rarely reveal the complete estate.
A register is necessary, but incomplete
Manual intake captures business context: purpose, owner, intended users and expected benefit. Technical discovery adds a different perspective. It can identify model endpoints, browser use, SaaS integrations, code dependencies, agent tools and service identities. Buyers should expect a platform to reconcile these signals rather than present separate lists.
Ask the supplier to demonstrate how an undeclared agent becomes a governed record, including its owner, tools, data access and lifecycle state.
Discover relationships, not just assets
A useful inventory shows more than a name and model. It connects the AI system to identities, data stores, APIs, tools, workflows, suppliers and downstream systems. These relationships reveal effective authority and help teams see where a failure could propagate.
Coverage also matters. A discovery claim should specify which environments are observed, how frequently signals refresh, and which blind spots remain. “Automated discovery” can mean anything from cloud configuration scanning to a connector that imports already-known records.
Turn discovery into a control workflow
- Correlate duplicate technical and business records.
- Assign an accountable owner and review date.
- Classify purpose, impact and operating context.
- Map identities, data and tools.
- Escalate systems that remain unowned or exceed policy.
The outcome is not a perfect map. It is a current, explainable control surface that makes unknown AI visible enough to govern.
Reference points
- NIST AI RMF: Map and Govern functions
- NIST Generative AI Profile: inventory and monitoring considerations