Internal
AI Tools
Audit
Employees will always use new tools ahead of policies, processes, and permissions. Generative AI is no different. Extensions, AI meeting recorders and tools have been introduced to aid day-to-day jobs before AI use cases are approved and implemented.
Find the AI tools
Check data and ownership
Keep, restrict or remove
Each tool has an owner and a clear decision.
Where the risk comes in
This can introduce risks. For example:
Someone summarises their inbox by copy/pasting client emails into ChatGPT on their own account, or worse, asking ChatGPT to connect to their mailbox, potentially including sensitive data. These accounts have no contractual terms agreed between you and the provider.
Microsoft 365 Copilot is switched on and reveals information it shouldn’t due to existing permissions being too broad.
A member of the sales team creates their own GPT that reads a shared folder. There’s no record of the prompt, how the folder is secured, or who can access the GPT.
Someone installs an extension to help them summarise websites or write emails in your tone of voice. If it has a data breach, what happens? Who’s liable?
Some existing tools, particularly in the Microsoft ecosystem, have AI features that are switched on by default. How can you switch them off, if needed? Who decides this?
Teams are building their own agents and automations that pull data from different places. How do you have visibility over this?
AI is advancing at pace, and it’s impractical and counter-productive to prevent people using new tools. Instead, our pragmatic approach is to understand what’s in use, review the associated risks and decide if it’s okay to allow this, possibly with controls.
The Audit
The AI Tools & Agents audit combines technical investigation with a series of short user interviews to understand what’s in use across your company.
From a technical side, we review SSO logs, admin portals, expense claims, AI features in existing tools, credit card statements, code repos etc. We know that finance and technical artefacts tell the truth about tooling, not procurement.
The outcome is an inventory of AI tools in use, including:
AI coding assistants
Embedded AI in existing tools, such as Microsoft 365 Copilot
Internal products that call AI models, such as customer-facing chatbots
Chatbots
Custom models/GPTs/agents
Browser extensions
What we do with the inventory
This is augmented by a review of acceptable use, whether it’s appropriate, and areas that need clarification. This is written in plain English that all users can understand, with suggestions for controls.
All items will be assigned a business owner, mapped to the types of data being used, and risk-rated. We can suggest mitigating controls, prioritise these for your IT & Security team and provide advice on any vendor due diligence that may be necessary. We will review any opt-outs or training requirements, particularly within the Microsoft tenant.
This can be supplemented by an EU AI Act review. We can review if you are acting as a provider or deployer, the types of systems in scope, and apply the ICO's AI and data protection guidance to draft a DPIA where necessary.
Deliverables include
Risk-rated AI tools & agents register with business owners
Draft acceptable use policy and recommended controls
Summary of any vendor due diligence required
EU AI Act scoping report (optional)
Draft DPIAs if required
Action list for IT & Security team, including examples of data classification
Switching off unnecessary AI features within existing tools
Required tenant configuration changes, such as Copilot training opt-out
Short board paper
Standards and repeat runs
The audit maps to ISO 42001, follows the structure of the NIST AI risk management framework and follows ICO and other regulatory guidance.
The audit can be repeated quarterly to provide an evolving register of acceptable AI tools in use.
Get in touch
Note that we’re a technical, not legal team. This audit provides a technical understanding of what’s going on, the regulatory considerations, and drafts that your legal advisers can finalise.
Pricing is fixed-fee for the discovery audit, with other elements charged separately. Get in touch to book a call and we’ll answer any questions.