Shadow AI
Within six months of ChatGPT's launch, Apple, JPMorgan, Samsung, and Verizon had restricted or blocked employee use of the tool. The risk wasn't hypothetical: employees everywhere were already pasting company data into it.
20 minutes. Policy-in-action scenarios, a shadow-AI sweep, and a touchpoint map of where AI hides. A safety score with feedback on every decision.
Before you start
- One real incident, played as decisions - no slides, no lectures.
- About 20 minutes, one sitting - leave early and you start over.
- You make timed choices; your score changes with your decisions.
- You get a safety score with feedback on every decision - never a leaderboard, never your name.
- Your firm sees completion evidence - never your answers. Teammates never see your score.
- Finish and you get a certificate with a unique ID anyone can verify.
Free for everyone. All 18 drills are free - finish and you get a verifiable certificate.
Usage came first. Governance had to catch up.
Spring 2023. Apple restricts ChatGPT and other external AI tools over leak fears - and advises against GitHub Copilot. JPMorgan restricts it under third-party software controls. Samsung bans generative-AI tools after several employees enter sensitive material, including source code. Verizon blocks it on corporate systems. Four different policies, one signal: usage had outrun governance.
Meanwhile, researchers at Cyberhaven watched 1.6 million workers: 4.2% tried to put company data into ChatGPT, and 11% of the data entered into ChatGPT was classified confidential. Most of it wasn't spying. It was ordinary work moving faster than policy - on accounts IT can't see, outside the firm’s data agreements.
Shadow AI = personal accounts, unapproved tools, browser plug-ins, and AI features silently added to approved software. If it's not on the list, it's not governed.
Monday. IT just sent the AI use policy.
Your team is already three tools deep.
You are Morgan, an ops manager. The company AI policy landed this morning: an approved-tools list, and a fast path to request new ones. Your team read it the way people read terms of service.
YOUR SCREEN
Three situations surface before lunch: a rep using personal ChatGPT for work email, a notes bot that auto-joins every call, and an approved tool that just turned on a new AI feature by itself.
A rep uses personal ChatGPT on their own phone for work emails.
A team adopted an AI notes bot that auto-joins every call - including the legal ones.
Your approved CRM just enabled a new "AI insights" feature by itself.
Find the shadow AI.
Select every tool or behavior that is shadow AI - unapproved, ungoverned, or silently enabled. Then check your work.
Call it like the policy does.
SAFETY
101
This certifies that
has completed Module 6 - Shadow AI: bring it into the light on with a safety score of /100 in of active time.
Safety score - governance: how your decisions held up, graded 0-100.
Objective: Surface unapproved AI tools and route them into governed use.
Seat time ~10-25 minutes. Verify this certificate at aisafety101.com/verify.
Evidence on record: module completion, seat time, final score, and certificate ID. This certificate ID verifies in your firm's admin report. A team certificate issues when every enrolled employee completes the full curriculum.
Your one rule to keep: if it's not on the approved list, it doesn't touch company data - and there's a fast path to get new tools approved. Use it.
Next: The Con. A scammer deepfaked the Ferrari CEO's voice on a live call. The deal died on one question only the real CEO could answer. Module 7 is waiting.