risk exposure scan
chatgpt.com
deepseek.com
copilot.microsoft.com
perplexity.ai
claude.ai
Financial services

When a trader pastes a position into a chatbot, the regulator's clock starts

Material non-public information in an AI prompt. Client portfolio details summarized by an unvetted tool. An analyst uploading a model to a vendor whose terms say nothing about training. Shadow AI in financial services is not a future risk. It is a present compliance gap with regulatory consequences.

Run the free audit See a sample report
11,841AI tools classified
85.5%silent on training terms
700+confirmed train-by-default
$0free preview, no card
shadow-ai-audit.pdf Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings. Sample report View all 11 pages Opens in your browser · PDF
Exposure paths

How sensitive financial data reaches unvetted AI vendors

Five recurring patterns, each routine at the point of action, each producing the same regulatory question.

The analyst's shortcut

Financial models, earnings data and portfolio compositions pasted into chatbots for summarization or formatting. The content is MNPI by definition, and the vendor is unvetted by compliance.

The client call transcript

Meeting bots and transcription tools recording client advisory calls. Account numbers, portfolio values and investment strategy discussed verbally, captured entirely, sent to a vendor with unknown retention terms.

The compliance draft

Compliance officers themselves using AI to draft regulatory responses, filing summaries and client communications. The irony: the team responsible for data controls creating the exposure while trying to work faster.

The quant's code assistant

Proprietary trading algorithms and risk models fed to code assistants for debugging or optimization. The intellectual property that defines the firm's edge, in a tool whose terms nobody in legal reviewed.

The spreadsheet upload

Client lists, transaction records and fee schedules uploaded to AI data-analysis tools. Structured data that maps directly to regulatory definitions of confidential client information.

The embedded feature

AI capabilities added to Bloomberg Terminal alternatives, portfolio management systems and CRM tools after the original vendor assessment. The vendor was approved; the AI feature was not.

The common thread: none of these involve malice. Every path is a professional trying to work faster with tools that are free, instant and invisible to compliance. Discovery is the only control that addresses all six simultaneously.

Regulatory landscape

Which regulators care about shadow AI, and why

Financial regulators have not written shadow AI rules. They do not need to. Existing frameworks already cover the exposure.

SEC / FINRA

Books and records requirements, supervision obligations and information barriers. Unmonitored AI tool usage creates gaps in supervisory systems that firms are already required to maintain.

BaFin / ECB

IT risk management and outsourcing requirements under MaRisk and DORA. An unvetted AI vendor is an unregistered outsourcing arrangement, regardless of whether anyone intended it as one.

FCA

Operational resilience, third-party risk management and consumer duty. AI tools handling client data without proper vendor assessment fall outside the firm's mapped critical third parties.

GDPR / Data Protection

Client personal data flowing to unrecorded processors. Every shadow AI tool used with client information is a processing activity missing from the firm's ROPA. The GDPR page covers the mechanics.

EU AI Act

AI system inventory and deployer obligations. Financial services firms using unregistered AI systems cannot comply with classification and transparency requirements. The AI Act page has the detail.

DORA

ICT risk management and third-party concentration. Shadow AI tools are unmanaged ICT services by definition, and concentration risk is invisible when the backend mapping is unknown.

The audit report's per-tool training verdicts, sovereignty flags and backend mapping produce the evidence each of these regulatory conversations starts from. One audit, six regulatory conversations answered.

Evidence preview

What a financial services audit report surfaces

A mock panel showing the kind of findings a bank or asset manager's audit typically produces. Sample data; the shape repeats.

shadow audit · financial services run
ToolCategoryTrainsVerdict dateUsersVolume
chatgpt.comGeneral chatYes, default2026-09-1447
otter.aiTranscriptionYes, default2026-09-1014
perplexity.aiSearch / researchNot stated2026-09-1223
copilot.microsoft.comCode assistantNo (enterprise)2026-09-1431
gamma.appPresentationNot stated2026-09-088
deepseek.comGeneral chatYes, default2026-09-146

The full sample report runs to ten pages: the exposure index and findings, the tool inventory with all verdict columns, the teams and per-user breakdown, an action plan and the control evidence statement. Open the sample report to see the complete format.

Worked scenario

A mid-size asset manager's first audit

A European asset manager, 350 staff, regulated by BaFin, running Palo Alto at the perimeter with Cloudflare Gateway for roaming analysts. They had no AI inventory.

What the audit found

  • 42 AI tools active across the firm. The compliance register listed zero.
  • Portfolio managers: 18 users on a free chatbot, pasting client portfolio summaries for meeting prep. Training: yes, by default.
  • Research team: 12 analysts using an AI search tool for market analysis. Terms: silent on training.
  • A transcription bot attending client advisory calls, installed by one associate, auto-joining 40+ recurring meetings.
  • IT: 8 developers using a code assistant on consumer tier with proprietary risk-model code.

What compliance did with it

  • Week 1: transcription bot blocked immediately. Client call recordings under unknown terms was a same-day escalation to the management board.
  • Week 2: chatbot migrated to enterprise tier with no-training clause and SSO. 18 portfolio managers moved to sanctioned access within 5 days.
  • Week 3: code assistant upgraded to business tier with IP indemnity. Research tool under vendor assessment.
  • Week 4: AI inventory filed with BaFin's IT risk report. Quarterly audit cadence established. The firm now answers "yes, we monitor AI usage" with dated evidence.

Elapsed time from export to filed inventory: 22 calendar days. The BaFin examiner's next annual IT audit found the process already running with two quarterly reports on file. No finding issued.

Department risk map

Where shadow AI concentrates in financial firms

Each department carries its own exposure profile. The audit's per-user attribution makes this map concrete for your firm.

Trading and portfolio mgmt

Highest regulatory risk per finding. MNPI in prompts, position data in summarizers, strategy documents in presentation tools. Every finding is a potential information-barrier breach.

Research and analysis

Deepest per-user usage. Analyst workflows generate the most sustained AI traffic: daily research summaries, data extraction and model validation. Volume means exposure duration.

Compliance and legal

The ironic cluster. Regulatory filings, investigation summaries and enforcement correspondence drafted with unvetted tools. The team enforcing controls creating the gap they are supposed to prevent.

Client services

Client PII and account details in support tickets, portfolio reports summarized for meetings, onboarding documents processed by free tools. Every client interaction is a data-flow event.

Operations and HR

Payroll data, employee records and performance reviews in drafting tools. Lower regulatory profile than front-office findings but high sensitivity under employment law and GDPR.

Technology

Proprietary algorithms, API keys and infrastructure details in code assistants. The IP that defines the firm's quantitative edge, in consumer-tier tools with training-by-default terms.

Response framework

From discovery to controlled state in four weeks

The financial services version of the detect-sanction-block sequence, calibrated for regulatory expectations.

Week 1: discover

Export 30 days of firewall or gateway logs. Upload. The report surfaces every AI tool, with training verdicts and user attribution. Share with the CCO the same day.

Week 2: triage

Critical findings first: MNPI-exposure tools blocked, transcription bots removed, abusive-purpose tools eliminated. These do not wait for procurement.

Week 3: sanction

Popular tools migrated to enterprise tiers with no-training commitments, SSO enforcement and audit logging. The sanctioned list published with clear usage guidelines per department.

Week 4: file and schedule

Inventory PDF filed with the IT risk register and outsourcing records. Next audit in the calendar. The quarterly cadence becomes a standing supervisory control.

Worried about policies? We have prepared default allow and block rules across 11,841 classified tools. Set optimized rules for your firewall in minutes, not weeks. Start with the free audit to see which rules your network needs.

Cyber insurance

Answering the AI question on your renewal form

Cyber-liability insurers now ask about AI usage controls. Financial services firms pay the highest premiums and face the most detailed questionnaires.

The question they ask

"Does the organization monitor employee use of AI tools?" A yes without evidence is an assertion that will not survive a claims investigation. A yes with quarterly audit reports is a documented control.

The answer that helps

"Quarterly log-based audit covering [X] tools, with training verdicts and per-user attribution. Reports on file since [date]. Sanctioned list maintained with [Y] approved tools." One sentence, three attachments.

The premium impact

Documented AI controls are becoming a factor in underwriting. Firms that can demonstrate monitoring and sanctioning processes are positioned for better terms, the same way MFA and EDR were five years ago.

Need to answer a cyber insurance questionnaire about AI usage? The audit report is designed to attach directly. Run one before your next renewal. Start the free preview now.

DORA compliance

Shadow AI as unmanaged ICT risk under DORA

The Digital Operational Resilience Act requires financial entities to identify and manage all ICT third-party risks. Shadow AI tools are unmanaged ICT services by definition.

ICT third-party register gap

DORA requires a register of all ICT third-party service providers. Every shadow AI tool is a provider missing from that register. The audit produces the observed list to reconcile against, with 11,841 classified tools as the matching reference.

Concentration risk

The backend mapping reveals which AI tools share the same model provider. If 15 tools all route to the same underlying API, that is concentration risk DORA requires firms to assess. The audit's mapping of 3,900+ tools to their providers makes this visible.

Incident reporting readiness

DORA requires ICT incident reporting within tight timelines. An AI data exposure incident requires knowing which tools, which data and which users were involved. The audit's per-user attribution answers all three from the file.

Ongoing monitoring obligation

DORA requires continuous monitoring of ICT risk. Quarterly shadow AI audits are a documented, repeatable monitoring control that fits directly into the ICT risk management framework.

Hand your CCO a finished evidence pack

The sample report demonstrates the exact document format: tool table, training verdicts, per-user breakdown, control evidence statement. Ten minutes of reading replaces a quarter of uncertainty.

Open the sample report
Log sources

Which infrastructure feeds a financial services audit

Financial firms typically run enterprise-grade firewalls. Any device that logs outbound hostnames per user works as the input.

Palo Alto with User-ID

URL-filtering logs with AD-mapped usernames. Export from Panorama for multi-site visibility. The most common source in financial services. Palo Alto guide

Zscaler ZIA

Cloud proxy logs with user identity from SAML. Covers every endpoint regardless of location. Zscaler guide

Cloudflare Gateway

DNS or HTTP logs with WARP identity. Strong for firms with remote analysts and distributed teams. Gateway guide

Mix sources freely. A firm with Palo Alto on the trading floor and Zscaler for roaming staff uploads both exports in the same audit run. The report merges and deduplicates automatically.

Getting started

Pricing for financial services teams

Start with a free preview to see the totals. Full reports with per-user attribution and training verdicts start at $99.

Free preview

Upload your logs, see the tool count and category breakdown. No card, no commitment. Useful for sizing the problem before the compliance meeting.

Run free now

One-time packs

$99 for a single report, or packs of 3 ($199) and 5 ($299) for quarterly cadence. The 5-pack covers a full year of quarterly audits plus a spare.

See all pricing →

Monthly plans

For firms running monthly audits or managing multiple entities. Plans from $99/mo include audit allowances, priority processing and quarterly trend reports.

See monthly plans →

Operational map

Where shadow AI appears in financial services work

AI adoption rarely begins as a formal platform project. It begins when a person finds a faster way to finish a familiar task. For bankers, advisers, traders, analysts and operations teams, that convenience can put client records, positions, research, payment details, models and material non-public information into services the organization has not assessed.

Research and analysis

Analysts summarize filings, compare issuers or debug spreadsheet formulas. Prompts can reveal unpublished theses, positions or client-specific assumptions.

Client communications

Advisers draft meeting notes and portfolio explanations. Names, holdings and suitability details can enter personal AI accounts.

Trading and surveillance

Teams test code, explain alerts or analyze execution data. Position information and surveillance logic may leave controlled systems.

Operations and payments

Staff classify exceptions, rewrite payment messages or investigate reconciliation breaks using tools that procurement never reviewed.

Compliance and legal

Employees summarize policies, complaints and regulatory correspondence. The material is sensitive even when it is not formally privileged.

Software delivery

Developers use coding assistants against proprietary pricing, risk and customer platforms, creating source-code and credential exposure.

Read the signal carefully. A domain match proves that an identity or network resolved an AI service during the audit window. It does not reveal a prompt or prove that regulated data was uploaded. Use the result to focus interviews, vendor review and technical investigation where they are most likely to matter.
Decision framework

Turn an inventory into defensible decisions

A useful program does more than count domains. It connects observed use to data, purpose, identity and vendor terms. That context lets the CISO, compliance, operational risk, legal and business-line owners choose a proportionate action and explain it later.

QuestionWhy it mattersPractical outcome
Is the tool approved?Approval confirms that ownership, terms and intended use were reviewed. A familiar brand is not evidence that the account or feature in use is sanctioned.Label the service approved, restricted, under review or blocked. Record the account tier and approved purpose, not only the vendor name.
What data could reach it?The same assistant can be low risk for public research and high risk for client records, positions, research, payment details, models and material non-public information.Define prompt examples by data class. Give users concrete red lines and a safe route for the useful workflow.
What do the terms say?Training, retention, subprocessors, location, deletion and administrative controls vary by plan and can change over time.Capture a dated vendor decision. Recheck material services on renewal and whenever the report shows a new domain or product.
Who is using it?Ten hits from one lab, practice or branch call for a different response than ten hits spread across public-research roles.Start with the highest-risk identity cluster. Ask about the task before deciding whether to coach, migrate, investigate or block.
Does an existing tool cover the need?Shadow adoption often signals that an approved platform is unavailable, difficult to use or poorly communicated.Remove friction, publish the approved route and measure whether users migrate during the next comparable audit window.
Six-step playbook

Run the first review without creating panic

The strongest first audit is narrow enough to explain and repeat. Use a normal operating period, preserve the source details and state the limits of DNS or proxy evidence in the report.

Choose a representative window

Start with 14 to 30 days that avoid a shutdown, migration or major outage. Record the dates, networks, identity coverage and exclusions. That scope statement makes comparisons honest and prevents a partial export from being mistaken for an enterprise census.

Export the minimum useful fields

From secure web gateways, DNS resolvers, CASB platforms and endpoint network telemetry, retain timestamp, hostname, action and the most useful identity field available. Do not add URL paths, request bodies or prompt content. Inventory work needs enough attribution to act, not the maximum amount of personal data.

Validate the largest clusters

Remove known test traffic, shared resolvers and infrastructure identities before interpreting user counts. Look for repeated use over several days and clusters within a team. A single lookup may be an email link or background process; a stable pattern deserves a conversation.

Add business context

Meet the relevant team with neutral questions: what task is being completed, what information is entered, which account tier is used and why the approved route does not work. Document the answer beside the technical observation so reviewers can distinguish evidence from inference.

Assign a proportionate action

Block services built for abuse or those with unacceptable terms. Migrate useful work to an enterprise product when controls can make it safe. Coach occasional low-risk users, and escalate suspected disclosure through the existing incident process rather than inventing an AI-only procedure.

Re-run and close the loop

Use the same source and similar window after remediation. Compare tool prevalence, active identities and sanctioned share. A decline supports closure; persistent traffic can reveal browser extensions, mobile devices, alternative domains or a workflow the replacement failed to solve.

Shared ownership

Give every function a clear part in the control

Shadow AI crosses technical, contractual and operational boundaries. A central policy works only when each function knows which decision it owns and where to send an exception.

Security and IT

Maintain discovery coverage, investigate technical anomalies and operate access controls. Security should explain what the logs prove and where visibility ends. It also checks whether sanctioned services support identity, logging, retention and configuration standards.

Privacy and legal

Translate observed workflows into data, confidentiality and notification questions. Review terms for training, retention, location and subprocessors. When facts suggest a disclosure, use the established legal and privacy assessment process rather than deciding from a domain count.

Procurement and vendor risk

Prioritize services that employees actually use. Confirm the exact plan, contracting entity and product features because one vendor can offer several materially different data practices. Preserve the assessment date and schedule a review for important services.

Business owners

Explain the task, data and reason for adoption. Decide whether the workflow is valuable enough to sanction, redesign or replace. Owners also nominate local guidance, test approved alternatives and confirm that remediation works in daily practice.

People and communications

Give employees examples they recognize, a simple approved-tool directory and a route to request new uses. Communications should avoid implying that DNS reveals prompts. Training is more credible when it solves the workflow that led users to the tool.

Internal audit and assurance

Test whether scope is documented, findings have owners, exceptions expire and follow-up runs verify change. Assurance can sample the chain from source export to final disposition without needing access to every identity in the operational report.

Evidence pack

What to preserve for audit, legal and leadership review

In financial services, the relevant obligations can include DORA and ICT third-party risk, SEC and FINRA supervision, GLBA safeguards, GDPR and banking secrecy, records-retention duties. A domain inventory does not satisfy those frameworks by itself. It supplies a dated factual layer that existing governance processes can use.

Scope statement

Identify the log source, dates, included networks and available identity types. List known blind spots such as unmanaged mobile data, direct IP connections or sites that use a different resolver.

This keeps later readers from giving the numbers more certainty than the collection method supports.

Observed-tool register

Keep the service name, matched domains, category, first and last observation, identities and sanctioned status. Store dated vendor-term research beside the observation rather than silently overwriting old decisions.

The result becomes a practical subset of the wider AI system inventory.

Decision record

For each material tool, name an owner, intended use, permitted data, account requirement and disposition. Include the reason for approval, restriction or blocking in language a business user can follow.

A short rationale is more useful than a color with no explanation.

Remediation evidence

Attach tickets, procurement decisions, configuration changes, user guidance and incident references where applicable. Link each artifact back to the finding it addresses.

This traceability shows that discovery led to controlled action rather than a report that was filed and forgotten.

Exception register

Some teams need a restricted tool temporarily. Record the business reason, data limits, accountable owner, compensating controls and expiry date.

Time-bound exceptions prevent urgent workarounds from becoming permanent, invisible policy.

Follow-up comparison

Preserve a comparable later report and explain major changes in scope. Track whether targeted identities moved, whether alternative domains appeared and whether approved services gained adoption.

Trend evidence makes the control testable instead of merely aspirational.

Worked example. A risk team sees one approved assistant, two consumer chatbots and a meeting bot in a 30-day export. The meeting bot clusters around wealth-management identities, so the team interviews that group first. It learns that client reviews were being transcribed through personal accounts. The firm preserves the audit, moves the workflow to an enterprise service, updates its approved list and checks the same identities in the next run.
Management view

Metrics that show control is improving

A large raw hit count is rarely a useful board metric because DNS caching and automated traffic distort volume. Favor stable measures tied to coverage, decisions and follow-through.

Inventory coveragePercentage of in-scope networks and identities represented in the export, with missing locations named.
Sanctioned adoptionShare of active AI identities using approved services during the period, tracked against the same population.
Unreviewed servicesNumber of newly observed tools with no owner or documented decision, plus their age since discovery.
High-risk identitiesDistinct identities reaching services marked for restriction or blocking, counted without implying confirmed disclosure.
Time to dispositionMedian days from first observation to approve, restrict, migrate, block or close as benign technical traffic.
Remediation persistencePercentage of targeted findings absent in the next comparable run, with bypasses investigated separately.
Program questions

Questions Financial services teams ask

Does a DNS match prove that sensitive information was uploaded?

No. It proves that a covered identity or network resolved a domain during the selected period. Confirm the workflow through interview, endpoint evidence or the vendor’s administrative logs before making a disclosure finding.

Why not block every public AI service immediately?

Immediate blocking can interrupt legitimate work and push users to personal devices or less visible services. Discovery first lets the organization protect urgent risks, preserve useful workflows and provide an approved alternative users will actually adopt.

Can this replace vendor risk assessment?

No. The inventory tells vendor risk which services are actually present and which deserve priority. Procurement, privacy, legal and security still need to assess terms, controls, subprocessors, location, retention and the intended data.

How often should the organization repeat the audit?

Quarterly is a practical baseline for a stable environment. Monthly review suits fast adoption, active remediation or higher-risk groups. Repeat after major policy, network or approved-tool changes, using comparable scope whenever possible.

What if the logs identify a device rather than a person?

Keep the device identity and map it through the asset system only when investigation requires it. Network-level attribution is still useful for locating a site or function, and the report should state that it does not represent a unique-user count.

How should employee communications describe the review?

Explain the business purpose, data sources, fields used, retention, who can see results and how findings will be validated. Clear notice supports trust and prevents a domain observation from being presented as surveillance of prompt content.

What belongs on the approved AI list?

Name the product and account tier, approved purposes, permitted data classes, required settings, owner and review date. A vendor-level approval is too broad when consumer and enterprise plans have different training and administrative controls.

When does a finding become an incident?

Use the organization’s existing incident criteria. Escalate when validation indicates that protected information entered an unauthorized service, credentials were exposed or contractual and regulatory duties may apply. The domain match alone is a lead, not the final conclusion.

FAQ

Financial services questions

Common questions from compliance officers, CISOs and CROs at financial institutions.

Is employee AI usage a regulatory violation?

That determination belongs to your compliance team per flow. The audit establishes the factual layer: which tools, which users, under which terms. The regulatory analysis runs on those facts.

Does the audit expose client data?

No. It reads hostnames, identities and timestamps from your network logs. No prompt content, no URL paths, no client data enters the audit. Uploads are discarded after each run.

Can we audit the trading floor separately?

Yes. Segment your log export by network zone, VLAN or user group. Each segment becomes its own report, and each report scopes to exactly that population.

How does this relate to DORA compliance?

Every shadow AI tool is an unregistered ICT third-party service. The audit produces the observed list for your ICT third-party register, with concentration risk visible through backend mapping.

What about Bloomberg and other market data terminals?

Sanctioned terminal AI features appear in the report as sanctioned tools, which is the correct classification. The sanctioned split keeps them separate from unsanctioned discoveries.

Where does the audit run?

Operated by Alpha Quantum, an EU company in Ljubljana, Slovenia. Uploads are processed and discarded, only the report is retained, deletable within its 90-day window.

How often should a regulated firm audit?

Monthly for front-office segments, quarterly at minimum for the full firm. Regulatory examination cycles consume the same reports, so filing frequency is also evidence frequency.

Can the report be included in regulatory filings?

Yes. The PDF's scope line, evidence statement and control summary are worded to stand alone as exhibits. File unedited for the strongest evidentiary position.

Sector list

Want the list without running an audit?

Every AI tool with a verdict for banking, as a CSV and ready block lists, from our sister site AI Tools Blocklist. One-time $790.

See the banking list

The regulator will ask. Have the answer ready.

Thirty days of logs, one upload, and your compliance team works from facts instead of assumptions. The free preview shows the totals today.

Run the free audit See pricing