Shadow IT Policy Template

This policy establishes the requirements for software, cloud services, and artificial intelligence tools used within [COMPANY NAME]. It applies to all employees, contractors, and third-party personnel who access [COMPANY NAME] systems, data, or networks.

The purpose of this policy is to ensure that all technology tools used for business purposes are assessed for security, compliance, and data protection risks before adoption. This policy does not prohibit the use of new tools. It requires that tools are evaluated through a risk-appropriate process before use with [COMPANY NAME] data.

Shadow IT: Any software, cloud service, hardware device, or AI tool used for business purposes that has not been approved through [COMPANY NAME]'s software procurement process.

Authorized Software: Applications listed in the [COMPANY NAME] Approved Software Catalog, accessible at [CATALOG URL].

Shadow AI: Any artificial intelligence tool, including generative AI chatbots, coding assistants, image generators, and AI-powered browser extensions, used for business purposes without IT department approval.

Sensitive Data: Data classified as Confidential or Regulated under [COMPANY NAME]'s Data Classification Policy, including but not limited to: personally identifiable information (PII), protected health information (ePHI), payment card data, intellectual property, and trade secrets.

3.1 Employees must use Authorized Software for all business activities involving [COMPANY NAME] data.

3.2 Employees must not enter Sensitive Data into any tool that is not listed in the Approved Software Catalog.

3.3 Employees must not create accounts on SaaS platforms using their [COMPANY NAME] email address without prior approval.

3.4 Employees must not install browser extensions, desktop applications, or mobile applications that access [COMPANY NAME] data without prior approval.

3.5 Employees must not use personal accounts (e.g., personal ChatGPT, personal Google Drive) for [COMPANY NAME] business activities.

3.6 Free-tier SaaS tools are subject to the same approval requirements as paid tools if they process [COMPANY NAME] data.

All new software requests are classified into three risk tiers with corresponding approval processes:

Tier 1 (Low Risk): Tools in the pre-approved catalog that do not process Sensitive Data. Approval: automatic. Timeline: immediate.

Tier 2 (Medium Risk): New tools that process internal (non-sensitive) data or require SaaS account creation. Approval: IT review including DPA assessment and SSO compatibility check. Timeline: 5 business days.

Tier 3 (High Risk): Tools that process Sensitive Data, Regulated Data, or require elevated access privileges. Approval: full security assessment, legal review, and DPA execution. Timeline: 15 business days.

Requests are submitted via [REQUEST FORM URL]. IT commits to the stated timelines for each tier.

5.1 All AI tools, including generative AI chatbots, coding assistants, image generators, and AI-powered productivity tools, are subject to this policy regardless of whether they are free, browser-based, or require no installation.

5.2 Employees must not enter Sensitive Data, proprietary code, trade secrets, customer data, or internal strategy documents into any AI tool that is not in the Approved Software Catalog.

5.3 AI-generated content used in customer-facing communications, legal documents, financial reports, or regulatory filings must be reviewed by a qualified human before publication or submission.

5.4 [COMPANY NAME] maintains an approved AI tool list as part of the Approved Software Catalog. Enterprise-licensed AI tools with data processing agreements, SSO integration, and audit logging are available for the following categories: [LIST CATEGORIES].

5.5 To support EU AI Act compliance (effective August 2, 2026), all AI tool usage must be documented. Employees must not deploy AI tools for decision-making that affects individuals without documented human oversight.

6.1 [COMPANY NAME] operates a rolling amnesty program for shadow IT self-reporting. Employees who voluntarily disclose unauthorized tools through the self-reporting form at [FORM URL] will not face disciplinary action.

6.2 Self-reported tools will be evaluated through the standard risk-tiered approval process. Tools that pass assessment will be added to the Approved Software Catalog. Tools that fail assessment will be migrated to approved alternatives with IT support.

6.3 The amnesty program is permanent and ongoing. It is not limited to a specific period.

6.4 Amnesty does not apply to tools that have already caused a data breach or compliance violation at the time of reporting.

7.1 Exceptions to this policy may be granted for legitimate business needs where no approved alternative exists.

7.2 Exception requests require: business justification, risk assessment, data classification of information to be processed, proposed compensating controls, and a defined review date.

7.3 Exceptions are approved by the IT Security team and reviewed at the next quarterly governance review.

7.4 Exceptions are time-limited (maximum 90 days) and must be renewed if the need persists.

7.5 All active exceptions are documented in the shadow IT governance dashboard.

Enforcement follows a graduated approach:

First occurrence: Education. Employee is informed of the policy, the specific risk, and directed to approved alternatives. No disciplinary action.

Second occurrence: Formal warning. Manager is notified. Employee acknowledges the policy in writing. IT monitors for continued usage.

Third occurrence: Escalation to HR for disciplinary review consistent with [COMPANY NAME]'s disciplinary policy.

Immediate escalation: Unauthorized tools processing Regulated Data (ePHI, PCI data) or creating an active compliance violation are blocked immediately regardless of occurrence count.

9.1 This policy is reviewed and updated annually by the IT Governance team.

9.2 The Approved Software Catalog is reviewed quarterly to add new approved tools and retire deprecated ones.

9.3 Shadow IT governance metrics are reported to leadership quarterly, including: total shadow apps discovered, shadow IT spend, compliance exposure, and governance maturity score.

9.4 Policy amendments are communicated to all employees within 30 days of approval.

9.5 Next scheduled review: [DATE].