AI Governance · Shadow AI Audit

Your staff are already using AI. Do you know which tools?

In one week we find every AI tool in use across your business, approved or not, show you what data is going into them, and hand you a usage policy ready to adopt.

£1,000 / €1,150 · Fixed price · One week

Book a 20-minute call Take the 2-minute quiz

The problem

Shadow AI is the most common gap

Staff paste client emails into ChatGPT, summarise contracts with free browser extensions, and switch on AI features in tools you already pay for. It's usually well meant. But it means:

You can't answer a client or auditor who asks which AI you use
Company and client data may be going to services you've never reviewed
Under the EU AI Act, the responsibility sits with the organisation, not the individual

AI tool register: every AI tool and AI feature in use, by team, with who uses it and how often
Data exposure map: what kind of data goes into each tool, and where it ends up
Risk flags: the tools that need action now, and why
AI usage policy: a ready-to-adopt policy covering approved tools, forbidden uses and the approval process for new tools
30-minute readout with you and your team lead

Kick-off (30 min)

Scope and access agreed.

Discovery (days 1–4)

A short staff survey, a review of software and browser extensions, and interviews with team leads. Nothing intrusive, no monitoring software.

Report (day 5)

Readout call

We walk you through it and answer questions.

Scope	Price
Companies up to around 100 staff	£1,000 / €1,150 · fixed
Larger organisations	Quoted on the call

If you go on to the full AI Readiness Diagnostic within 30 days, the £1,000 is credited in full.

Companies that suspect AI is being used but have no policy
Operations, IT and compliance leads who need an answer for a client questionnaire
Anyone about to start a Diagnostic who wants a quick first step

Will you monitor our staff?

No. We use a short anonymous survey, software records and conversations with team leads. No tracking software is installed.

What if we find nothing?

Then you have written evidence that your AI use is under control, which is useful for clients and auditors too.

Is this the same as the Diagnostic?

No. The audit finds what's in use and puts a policy in place. The Diagnostic goes further: roles, risk levels, gaps and a roadmap against the EU AI Act.

Websfarm is an implementation partner, not a law firm. The information on this page is general and is not legal advice. For a legal opinion on your position, speak to a qualified lawyer. We're happy to work alongside yours.

Your staff are already using AI. Do you know which tools?

Shadow AI is the most common gap

What you get

One week, four steps

Kick-off (30 min)

Discovery (days 1–4)

Report (day 5)

Readout call

£1,000 / €1,150, fixed

Who it's for

Questions we get asked

Find out what's really running.