Shadow AI in Government: Classified Data and Compliance Risks

Q: Does this satisfy the EO 14110 AI inventory requirement?

It provides the discovery layer. The audit identifies which AI tools are actually being used on your network, which is the first step in building the AI use case inventory the executive order requires.

Why Government Shadow AI Is a National Security Concern

Government data ranges from public records to classified intelligence. Unsanctioned AI tools create exfiltration paths that bypass existing security controls and violate executive orders on AI governance.

Sensitive Policy Documents

Policy analysts paste draft regulations, interagency memos and legislative analyses into AI tools for editing and summarisation. These documents may be pre-decisional, export-controlled or classified.

Citizen Data

Caseworkers and benefits administrators paste citizen applications, tax records and immigration files into AI tools for processing assistance. PII flows to foreign-owned AI servers.

Procurement and Contracts

Procurement officers upload RFP documents, vendor proposals and cost estimates to AI analysis tools. Contract terms, pricing and source selection information reach uncleared vendors.

Law Enforcement

Officers and analysts use AI tools for report writing, evidence summaries and investigative research. Case details, witness information and intelligence data flow to commercial AI platforms.

Legislative Staff

Congressional and parliamentary staff use AI to draft speeches, analyse bills and respond to constituent inquiries. Legislative strategy, unpublished positions and constituent data reach third parties.

Foreign Affairs

Diplomatic staff use AI translation and summarisation tools for cable processing. Classified communications and negotiation positions may be exposed to commercial AI vendors without clearance.

Executive Order and Regulatory Mapping

Federal AI governance mandates require an inventory of AI tools in use. A shadow AI audit provides the discovery layer these requirements demand.

Requirement	Source	Shadow AI Gap	What the Audit Produces
AI Use Case Inventory	EO 14110 (2023)	Unsanctioned tools missing from agency inventory	Complete AI tool list from network traffic
AI Risk Management	NIST AI RMF	Unassessed AI tools in production use	Risk-scored inventory mapped to RMF categories
FedRAMP Compliance	FedRAMP	AI tools not FedRAMP authorised	Authorisation status per AI vendor
Data Sovereignty	FISMA / Agency policy	Data sent to foreign-owned AI services	AI vendor country-of-origin and data-residency flags
Records Management	Federal Records Act	AI-generated documents not in records system	AI tool usage patterns for records policy updates
Privacy Impact	E-Government Act	PII in AI tool prompts not assessed	Department-level usage data for PIA scoping

What Your Agency Audit Report Shows

Sample excerpt from a shadow AI audit of a mid-sized federal agency (2,400 employees).

SHADOW AI AUDIT - FEDERAL AGENCY

Scan Period21 days (DNS + web proxy)

Total AI Tools Found41 unique AI services

FedRAMP Authorised4 of 41

Foreign-Owned Vendors7 of 41

Tools Training on Input14 of 41

TOP FINDINGS

ChatGPT (Free Tier)3,891 queries - not FedRAMP, trains on input

Copilot (M365 Gov)2,104 queries - FedRAMP authorised

Perplexity612 queries - not FedRAMP, trains on input

DeepL Translator445 sessions - German-owned, stores translations

COMPLIANCE STATUS

Not FedRAMP authorised

FedRAMP authorised

Related Resources

Role Guide

For CISOs

Board-ready risk metrics and remediation roadmaps.

Compliance

AI Governance Inventory

Build the tool inventory executive orders require.

Role Guide

For Risk Committees

Executive briefing format and governance cadence.

Industry

Financial Services

Regulated industry parallel for shadow AI governance.

Government Shadow AI FAQ

Does the audit require ATO or security authorisation?

No. The audit processes log files you export. No software is installed on your network. You upload a DNS or proxy log file to our platform, which processes it and returns a report. The log file contains domain names and timestamps only, not document content.

Can this run on classified networks?

The audit is designed for unclassified networks. For classified environments, you would export the log data through your approved cross-domain solution or process it within your classified enclave. Contact us for air-gapped deployment options.

Does this satisfy the EO 14110 AI inventory requirement?

It provides the discovery layer. EO 14110 requires agencies to inventory AI use cases. The audit identifies which AI tools are actually being used on your network, which is the first step in building that inventory. The audit findings feed directly into your AI governance documentation.

How do we handle findings with our IG office?

The audit report is designed for Inspector General and oversight review. It provides factual, evidence-based findings from network logs. Most agencies share the aggregate report with their IG, CIO and CISO simultaneously to demonstrate proactive governance.

Shadow AI in Government: Data Sovereignty at Stake