ShadowAI · Free tool

AI Tool Risk Index

25 AI tools employees actually use, scored on whether a written policy can be enforced against them — training on your data, administrative control, and independent assurance. The rubric is published below; the data is free to download.

How the score is calculated

The score is out of 10, and it is built only from facts that can be checked against a vendor's published terms. Nothing subjective is folded in silently:

• Governance tier (3 points) — Approved = 3, Limited = 1, Prohibited = 0. The tier already reflects whether the tool can be governed by a written policy at all.
• Training on your data (3 points) — Does not train on your content = 3, depends on a setting = 1, trains by default = 0.
• Administrative control (2 points) — IT can see, manage and offboard accounts = 2; otherwise 0. Consumer accounts score 0 because the company does not hold them.
• Independent assurance (2 points) — A published third-party certification = 1, a BAA available for regulated data = 1.

A high score does not mean a tool is safe for every use, and a low score does not mean it must be banned. It means the tool is easy or hard to govern — whether a written policy can actually be enforced against it. The most common shadow-AI problem is not a dangerous tool; it is an ordinary tool used through a personal account that IT cannot see.

What the tiers mean

Approved — business terms exclude your content from training by default, and IT has an admin console. A policy can be enforced against it.

Limited — usable for some work, but something material is outside your control: consumer terms, an opt-out the user controls, or no administrative visibility. These need a named, bounded use case in the policy rather than a blanket yes or no.

Prohibited — the terms or the data handling are incompatible with company or client data. These belong on a named block list, because "use good judgment" does not survive contact with a free tool that works well.