Mapping shadow AI: the AI inventory for ISO 42001 and the AI Act

Organisations starting on AI governance usually want to write a policy first. The better first question is which AI the organisation already uses. The answer is almost always broader than what IT can see. Employees use personal accounts on free chat services, departments sign up for subscriptions themselves and vendors switch on AI features in software that has been running for years. That use outside the view of IT and compliance is called shadow AI.

Why shadow AI arises

Shadow AI rarely comes from bad intent. The tools are free or cheap, run straight in the browser and help with ordinary work: summarising a report, drafting an email, reviewing code. If there is no policy, or the policy is so strict that nobody can work with it, people find a way around it.

The risk lies in what happens along the way. Confidential documents or personal data go to an external service without a data processing agreement. With free versions, the information entered may be stored and used for training. Decisions rely partly on an output whose reliability nobody has assessed. At the end of 2025 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) reported that the number of data breach notifications caused by employees using AI chatbots is rising quickly. Its advice: record which data may and may not be entered into AI systems.

What counts as AI in the inventory

The AI Act defines an AI system in Article 3(1): a machine-based system that operates with some level of autonomy and infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions. The European Commission published guidelines on that definition in February 2025. Not every piece of software with a clever feature falls under it. Still, start broad for the inventory and filter afterwards, because you cannot justify excluding an application you never wrote down.

Besides in-house models and a central chat assistant, think of lead scoring in a CRM, CV screening in HR software, sentiment analysis in customer service tools, writing assistants in office suites and fraud detection in financial systems. Much of this sits as a feature in software that has been in use for a long time and was added by a vendor at some point.

What the standard and the law ask for

ISO/IEC 42001 requires you to determine the scope of the AI management system in clause 4.3. You cannot justify that scope without knowing which AI systems exist. Annex A builds on this. A.4 asks you to document the resources for AI systems: data, tooling, system and computing resources, and people. A.9 covers use of AI systems in line with their intended purpose, A.10 covers suppliers and customers. More on how the standard is structured is in ISO 42001 explained.

The AI Act does not require a register of all your AI use. Your obligations do depend on your role for each system (provider, deployer, importer or distributor) and on the risk class, and you cannot determine either without an overview. How to establish the risk class is covered in risk classification under the EU AI Act. The AI literacy measures in Article 4 also assume you know which systems staff work with (see AI literacy under Article 4). Where personal data is processed, that processing also belongs in the record of processing activities under the GDPR.

How to approach the inventory

Work from several sources at once, because each source misses something.

Ask each department, not just IT. Marketing, sales, finance and HR often account for most of the use. Ask concrete questions: which tools do you use, which have AI features, what data goes in and which decisions rely on the output?

Look at the administration. Purchase invoices, credit card statements and expense claims show subscriptions that never went through IT.

Look at the technology. Proxy or firewall logs, the connected apps and OAuth consents in the identity platform and installed browser extensions show which services are actually in use.

Ask your vendors. Add a question to vendor management on whether a product contains AI features, whether they are on by default and what happens to the data. This is where AI governance meets third-party risk management.

What to record for each system

For each system, record at least: the purpose, the owner, the vendor, the departments using it, the data that goes in and whether it includes personal data, the decisions that rely on the output, your role under the AI Act and a first estimate of the risk class. With that information you can then carry out the risk assessment and, where needed, an impact assessment following ISO 42005.

From snapshot to process

An inventory that was only filled in at the start soon falls behind. Vendors add features and employees take up new tools. So link the register to processes that already exist: procurement and contract management, change management, the introduction of new applications and a periodic review with a named owner. Give employees a simple way to report a new tool.

We advise against tackling shadow AI with a ban alone. A ban without an alternative mostly makes the use invisible. An approved business version with agreements on data, plus clear rules on what may not be entered, gives more control.

What an auditor looks at

In an ISO 42001 audit, the auditor tests whether scope and register match practice, among other things through samples and interviews. If the auditor finds an AI application in a department that is not in the register, the scope is open to question, and so is the risk assessment that rests on it. So show how you keep the register current: when it was reviewed, by whom and with which sources. What else auditors run into is covered in ISO 42001 certification in practice. If you want the inventory set up or tested, see our compliance work.