AI and Intelligent Automation Assessment

Shadow AI and AI Sprawl Governance Maturity Assessment

Evaluates an organization's ability to set rules for, discover, protect, procure and fund AI tool adoption across the enterprise, including the tools nobody told IT about.

Register to take this assessment See what we assess

Already have an account? Log in to start

Who it is for

  • IT Governance and Architecture
  • Information Security
  • Procurement and Finance
  • Legal, Risk and Compliance
  • Process Owner/Full Model Assessor

CIO / CISO / IT Governance Lead / Chief AI Officer. Secondary: data protection officers, procurement and vendor management, legal and compliance, IT finance.

What you will gain

Shows whether AI tool adoption is governed or merely tolerated, exposes where data, money and risk escape through unsanctioned tools, and gives each gap a concrete next step and a measurable target.

About this assessment

Shadow AI is one of the fastest-growing unmanaged risks in enterprise technology. Employees adopt chat assistants, coding assistants, browser extensions and niche AI services faster than governance can keep up. Most organizations do not know how many AI tools are in use, what data flows into them, who pays for what, or whether any of it meets regulatory requirements.

This assessment follows the order in which shadow AI governance has to be built. It starts with Policy and Acceptable Use, because discovery cannot sort tools into sanctioned, tolerated and prohibited until the policy defines those tiers. It then tests Discovery and Visibility (can you find what is out there), Data Leakage and Protection (is sensitive data leaving through AI tools), Procurement, Vendor Risk and Compliance (does every tool pass a real risk, contract and regulatory check), and Spend, Value and Enablement (where the money goes, whether it pays off, and whether people have approved tools good enough that they stop going around the rules).

Each question is scored on whether the capability is documented, implemented and effective, so the results separate governance that exists on paper from governance that works, and name Paper Tigers, Tribal Knowledge and Measurement Gaps. Every score comes with specific guidance on what to fix next. AI Spend Management, Data Loss Prevention Operations and AI Governance are companion models for deeper coverage of those areas.

What we assess: 5 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 5 questions

1 Policy and Acceptable Use

Acceptable use policy, data rules for AI, personal versus corporate accounts, policy communication and acknowledgment, AI literacy and safe use training

02 · 5 questions

2 Discovery and Visibility

AI tool inventory, automated discovery, risk-based classification and tiering, usage telemetry, detection speed for new tools

03 · 5 questions

3 Data Leakage and Protection

Data loss prevention for AI data paths, prompt content monitoring, vendor data handling review, output governance, AI data exposure incident response

04 · 5 questions

4 Procurement, Vendor Risk and Compliance

Centralized procurement, vendor risk assessment, regulatory and data residency checks, contract terms review, AI-specific risk register

05 · 5 questions

5 Spend, Value and Enablement

Consolidated AI spend, license utilization, value tracking, approved toolset, shadow-to-sanctioned fast track

KPIs to track

Measures that show whether the improvements hold.

KPI
Shadow AI Ratio - Unsanctioned AI tools found in use versus sanctioned tools. Target: declining every quarter.
Mean Time to Detect New Shadow AI - Calendar days from first use of a new unsanctioned AI tool to detection. Target: under 7 days.
AI Data Exposure Incidents - Confirmed sensitive data exposures through AI tools per quarter. Target: zero, with near misses declining.
Centralized AI Spend Coverage - Share of AI-related spending captured in the consolidated view. Target: 90% or more.
Policy Recall Rate - Share of employees who correctly describe the AI acceptable use rules in spot checks. Target: 80% or more.

Framework alignment

Questions are written in plain language and mapped to:

  • ISO/IEC 42001:2023
  • ISO/IEC 27001:2022
  • NIST AI RMF 1.0
  • NIST CSF 2.0
  • NIST SP 800-53 Rev 5
  • NIST SP 800-61 Rev 3
  • EU AI Act
  • OWASP Top 10 for LLM Applications 2025
  • CIS Controls v8.1
  • COBIT 2019
  • ITIL 4

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

IT Asset Management: provides the inventory and license practices the AI tool inventory builds on.
Data Loss Prevention Operations (v8.9.6): covers DLP rule management and alert handling in more depth.
AI Spend Management (v12.9.6): covers AI cost allocation, forecasting and optimization in more depth.
AI Governance (v11.9.6): provides the wider AI management system within which shadow AI governance operates.
Recommended: have a current AI tool inventory extract and discovery report ready before the assessment.

What you get

Maturity scores

An overall score and a score for each of the 5 domains.

Gap analysis

A clear view of where current practice falls short, and why it matters.

Improvement recommendations

Prioritized next steps to move each area to the next level.

Detailed report

Results you can share with leadership and track over time.

See where you stand on Shadow AI and AI Sprawl Governance Maturity Assessment

Register, take the assessment, and get your maturity score with a clear improvement roadmap.

Register to take this assessment

Start Measuring Your Maturity Today

Get Started Free

Contact us

© 2026 ITSGovernance, part of SMCE. All rights reserved. Cookie settings