FirstCall Federal770-335-6136
Free checklist · AI risk

The Shadow AI and AI Vendor Risk Checklist

Where to look for unapproved AI in your company, and the questions to ask every AI vendor before your data goes in.

  • Six places shadow AI hides, and how to find it
  • A simple way to decide what to approve, replace or block
  • Vendor questions on training, retention, location and subprocessors

Get the free checklist

Free PDF. We'll email you a copy too.
What's inside

4 sections, from discovery to vendor review

Find shadow AI

Personal chatbot accounts, AI note-takers, browser extensions and AI features added to tools you already approved.

Decide what to keep

Approve, replace or block, with a short list everyone can see.

Review each AI vendor

Training on your data, retention, data location, subprocessors and incident notice.

Assess AI you build

Prompt injection, data leakage and access checks for your own AI tools, plus a risk-to-control table.

Who it's for

Built for

  • Security and compliance leaders who suspect staff are already using AI
  • Companies under CMMC, HIPAA, SOC 2 or PCI DSS adding AI vendors
  • Teams building AI features into their own products

Rather talk it through?

Our AI risk and security assessment finds shadow AI, reviews your AI vendors, rates risk against the NIST AI RMF and tests the AI tools you build.

Book a 30-minute call