Find every AI tool your organisation uses — including the ones nobody approved.
Accord discovers AI use across endpoints, browsers, SaaS and cloud, then brings it under one register with an owner, a risk rating and a policy.
Short answer
Shadow AI is any AI tool, model or assistant in use inside an organisation without security knowing about it or reviewing it. It arrives through individual sign-ups, free tiers, browser extensions and team pilots — and company data leaves with it, through prompts, file uploads and API keys.
The problem
AI adoption is not waiting for a review.
- Employees and teams adopt AI assistants, copilots and APIs faster than security can review them.
- Company data leaves the organisation through prompts and file uploads.
- Leadership cannot answer “which AI are we using, and with what data?”
How Accord gives you visibility
Discover it, classify it, decide on it, then keep it on the record.
- 1
Discover AI use
Find AI tools, assistants and APIs in use across endpoints, browsers, SaaS and cloud — not just the ones that came through procurement.
- 2
Classify each one
Record the vendor, the data sensitivity involved and the business owner accountable for it.
- 3
Risk-rate and decide
Approve, restrict or block each tool by policy, so the decision is written down instead of assumed.
- 4
Keep the AI register
One register of what is in use, mapped to ISO 42001, the EU AI Act and DPDP obligations.
Who it’s for
CISOs and CIOs without dedicated AI governance staff
One person can run the register, chase owners and report on progress without a new team.
Regulated firms
BFSI, healthcare and listed companies that have to show what was assessed, when, and by whom.
Engineering and industrial companies
Teams rolling out copilots across developers, operations and field staff — quickly, and in order.
Questions we get asked
What is shadow AI?+
Shadow AI is any AI tool, model or assistant in use in an organisation without security or compliance knowing about it or reviewing it. It arrives through individual sign-ups, free tiers, extensions and team-level pilots, and company data passes through it without a review.
How do you discover AI tools in use?+
Accord looks for evidence of AI use across endpoints, browsers, SaaS and cloud, then combines what it finds with what owners declare. Each finding is classified by vendor, data sensitivity and business owner, so discovery ends in a register rather than a list.
Does this block employees from using AI?+
No. Blocking is one of three outcomes available per tool. Most organisations approve a small set of tools, restrict others to low-sensitivity use, and block the rest — and change the decision as evidence improves.
How does this relate to ISO 42001 and the EU AI Act?+
ISO 42001 expects an AI management system with an inventory, assigned accountability and evidence. The EU AI Act expects AI systems to be identified and classified by risk. Accord keeps both in one register, alongside DPDP obligations where personal data is involved. It supports the work; certification is issued by accredited bodies.
See what is already running in your estate.
No obligation. If AI visibility is not the right starting point, we will say so.