AI Tools

AI Risk & Policy Tools

Screen for potential Shadow AI risks, draft an AI policy for legal review, and explore potential security exposure from AI integrations.

Shadow AI Risk Assessment

Review potential warning signs of unauthorized AI use and data-handling gaps.

6 questions · ~2 minutes · Instant results

Educational self-reported screening, not a verified audit, diagnosis, or compliance determination. The score is not a probability of a breach. Answers and controls have not been independently verified; a low score does not establish safety.

Screening methodology

Add the points shown beside each selected answer: questions 1–5 score 0–3 each; question 6 scores 0–2. Total 0–17. Low: 0–2; Moderate: 3–5; High: 6–9; Critical: 10–17.

These editorial weights and thresholds are not a validated risk model. All questions are required; there is no not-applicable adjustment. If a question does not fit your environment, treat the result cautiously and seek a contextual review. Results are cleared when answers change; calculate again after edits.

1. Do employees use personal AI subscriptions (ChatGPT, Claude, Gemini) for work tasks?

Yes — commonly, across most teams (3 points)Yes — occasionally or in certain departments (2 points)Rarely / only a few individuals (1 points)No — we have confirmed controls in place (0 points)

2. Does your organization have an officially approved AI tool for employees?

No — employees fend for themselves (3 points)We're evaluating options but nothing is official yet (2 points)Yes — approved tool exists but not widely adopted (1 points)Yes — approved tool, trained staff, and monitored usage (0 points)

3. Have employees received training on what data is safe to share with AI tools?

No formal training whatsoever (3 points)We've mentioned it in passing or via email (2 points)One-time training, but not recently (1 points)Regular, documented AI data-safety training (0 points)

4. Has anyone submitted client data, contracts, or PII to an AI chatbot?

Yes — we know this has happened (3 points)Likely — we can't rule it out (2 points)Unlikely — but we can't confirm (1 points)No — we have logging and can verify (0 points)

5. Does your organization have a written AI Acceptable Use Policy (AUP)?

No policy exists (3 points)Draft in progress — not yet enforced (2 points)Policy exists but employees aren't aware (1 points)Published, signed, and regularly reviewed (0 points)

6. Is AI-generated content used in client deliverables or public communications without review?

Regularly — no review process (2 points)Sometimes — ad hoc review (1 points)Never — always reviewed and attributed (0 points)

AI Policy Generator Template

Input your industry and team details to generate a baseline AI Acceptable Use Policy

⚠ For guidance only — consult legal counsel before implementing

Your Organization

Industry

Team Size

1–10 employees11–50 employees51–200 employees200+ employees

Approved AI Tools (select all that apply)

ChatGPT (paid/enterprise tier)Microsoft Copilot (M365 integrated)Google Gemini for WorkspaceInternal / Private AI (on-premises)Claude (Anthropic — enterprise)No AI tools currently approved

Sensitive Data Types You Handle

Protected Health Information (PHI / HIPAA)Personally Identifiable Information (PII)Financial Records / PCI DataLegal / Attorney-Client Privileged DocsProprietary IP / Trade SecretsClient Contracts / Proposals

Generated Policy

Configure your organization details on the left and click Generate My AI Policy to receive a customized AI Acceptable Use Policy template.

AI Security Exposure Calculator

Assess the specific risks introduced by your AI integrations — data protection, model security, and compliance exposure

Screening methodology

Add the points shown beside each selected answer: questions 1, 2, 3 and 5 score up to 3 each; questions 4, 6 and 7 score up to 2 each. Total 0–18. Low: 0–3; Moderate: 4–7; High: 8–11; Critical: 12–18.

1. Do you use third-party AI APIs (OpenAI, Anthropic, Azure AI, Google AI) in your products or operations?

Yes — customer or patient data is sent to AI APIs (3 points)Yes — only internal/non-sensitive data (1 points)No — AI is not integrated into our systems (0 points)

2. Do you have a signed Data Processing Agreement (DPA) with your AI service providers?

No — we haven't reviewed the terms (3 points)Not sure — we use standard consumer terms (2 points)Yes — enterprise DPA in place (0 points)

3. Is AI output used in automated decisions without human review?

Yes — fully automated decisions (pricing, access, approvals) (3 points)Partially — some automated, some reviewed (1 points)No — all AI output is reviewed by a human (0 points)

4. Are all AI API calls logged and monitored for anomalies?

No logging in place (2 points)Basic logging only — no alerting (1 points)Full logging with alerting and retention (0 points)

5. Are proprietary models or fine-tuned training data stored with third-party AI providers?

Yes — unencrypted or with no data residency controls (3 points)Yes — encrypted at rest, residency controlled (1 points)No — models are self-hosted or on-premises (0 points)

6. Is access to AI tools and APIs role-restricted for employees?

No controls — anyone can access or set up AI integrations (2 points)Some controls, but not consistently enforced (1 points)Full RBAC — access requires approval and is audited (0 points)

7. Do you test AI systems for adversarial attacks (prompt injection, data extraction)?

Never — not on our radar (2 points)Occasionally or informally (1 points)Yes — regular AI security testing in our SDLC (0 points)

AI Risk & Policy Tools

Shadow AI Risk Assessment

AI Policy Generator Template

Your Organization

Generated Policy

AI Security Exposure Calculator

Your privacy, simply.

Choose what’s optional

Useful storage, on your browser

Necessary — always active

Reviews without a review tracker