Short answer
Start by mapping where AI is already being used, what data is going into those tools, who relies on the output and where human review or approval is missing. The aim is to bring AI use into the open, not punish staff for trying to work faster.
List the tools before judging them
Ask teams which AI tools, browser extensions, meeting assistants, writing aids and automation features they already use. Include personal accounts, free tools, shared logins and features built into products the business already pays for. Keep the first pass factual: tool, user, purpose, data type and output.
Look for sensitive data boundaries
The risky point is usually not that a tool exists. It is what staff paste, upload, connect or summarise with it. Mark any use that touches client information, customer records, contracts, HR data, financial details, credentials, commercial plans or regulated work. If the data position is unclear, treat the use as amber until it is reviewed.
Ask staff without creating a witch hunt
People are more likely to be honest if the exercise is framed as safe adoption. Ask what AI is helping with, where outputs are useful, where they are unreliable and where people feel exposed. A punitive tone drives shadow AI deeper underground and makes the business less safe.
Score each use red, amber or green
Green uses are low-risk, non-confidential and reviewed by a person. Amber uses may be useful but need clearer rules, supplier checks or human review. Red uses involve sensitive data, client work, important decisions or unclear ownership and should be paused or redesigned before continuing.
Turn the findings into controls
The checklist should end with practical next steps: approved low-risk uses, prohibited uses, workflows that need a risk assessment, tools that need supplier review, and one named owner for the next decision. Do not let the output become a spreadsheet nobody revisits.