“Cercanos, ejecución impecable y resultados que hablan por sí solos. El proyecto se convirtió en un referente.”
Cliente verificado
SERVICE
Shadow AI audit: which AI your company really uses
Before banning anything or buying anything, you need to know what is in use. A shadow AI audit builds the real inventory of tools, accounts, agents and employee-built applications, and prioritises risk by data and criticality.
What the audit includes
We start with the inventory: which AI tools are used, with which accounts, who pays for them and which applications appeared without IT. It is done through interviews and available technical evidence, without turning it into a witch hunt.
Then we measure exposure: which data those tools have touched, which applications hold customer or employee information and which systems are critical. Every finding is classified by likelihood and impact.
The deliverable is an executive report, the prioritised inventory, a 90-day action plan and a governed-lane proposal so what the business needs keeps being built without ending up in the same place.
THE CHALLENGE
Auditing AI that nobody declared
You cannot audit what is not inventoried. The first finding of almost every AI audit is that half the usage appears in no record at all.
Undeclared usage
Tools paid for with personal cards, applications built over a weekend and agents installed without going through IT.
Untraceable data
Nobody knows which customer information was sent to which provider or what has been stored on their servers.
No evidence
When the audit question or a large customer asks, there is no inventory, no decision record and no documented legal basis.
APPROACH
How a real audit is done
We combine technical review, interviews and verifiable evidence: what cannot be demonstrated does not count as a control.
Technical discovery
We review accounts, expenses, domains, repositories and cloud environments to locate AI usage that bypasses official channels.
Data map
For each use identified, we document which data goes in, with which provider, where it is processed and where it remains.
Compliance assessment
We check each case against GDPR and the AI Act obligations that apply, based on its purpose and the risk of the context.
Prioritised closure plan
Every finding carries an action, an owner and a deadline: critical items close first, not the easiest ones to fix.
DELIVERABLES
Evidence you can show
The result is a report that stands up before leadership, a corporate customer and a supervisory authority.
Audit report
Usage inventory, findings ranked by severity and a clear conclusion on the current level of exposure.
Risk matrix
Each use scored by data handled, impact and likelihood, with a justified remediation priority.
Processing record
Documentation of providers, purposes and legal basis, ready to fold into your record of processing activities.
Remediation plan
Concrete actions with owner and date, plus a verification criterion to prove each one has been closed.
TRUST
Audit with technical judgement
We review systems and security practices in companies since 2008, with offices in Barcelona and Madrid and remote collaboration across Spain, Europe, LATAM and the US. ENS-aligned practices and a least-privilege approach to client data.
- You know how many AI applications exist and who owns each one.
- You can show auditors which systems exist and which data they handle.
- There is an applicable policy and a fast lane for what the business needs.
- AI spend stops being an opaque line on the invoice.
FAQ
Questions about shadow AI audit
Have a project in mind?
Tell us what you need around shadow AI audit. We will help you turn it into a clear, viable delivery plan.
