The audit report, page by page

The answer before the detail

The cover carries the four headline findings and four numbers, so someone who reads only one page still gets the point. It also records who the report is for, how much evidence it is based on (5,693 log lines in the sample) and the date.

37 AI tools in use. 9 should be blocked.

The title of this page is always the two numbers that matter most. Below it sit the AI exposure index, six tiles and up to five findings written in plain sentences, then a bar that splits every tool into Block, Allow with controls and Allow under the rules you chose.

The exposure index runs from 0 (no unmanaged AI) to 100. It rises quickly with a few serious findings: high-risk tools, tools holding data under high-risk jurisdictions, abusive-purpose tools and tools that train on user data weigh most, and every tool not on your approved list adds a little. The sample scores 84, which is severe.

Where the risk sits

Four views of the same tools. The risk level ring splits them into high, medium and low. The training grid gives one square per tool, coloured by what the vendor's own terms say about training on what users type. The category bars show what kind of AI is in use. A table at the bottom names the highest-risk tools and says why each is rated high.

Three smaller tiles count tools with high data-sovereignty exposure (6 in the sample), abusive-purpose tools such as deepfake or "nudify" generators (1), and AI-native tools against AI features inside other apps (34 / 3).

13 risk factors, tool by tool

Every tool in the register is assessed on 13 factors taken from its jurisdiction, its purpose and the vendor's own published terms. The bars count how many of your tools carry each one. Red factors raise risk on their own, amber ones need a decision, green ones are protections you can use.

Who uses what

When your export names users as TEAM\user, as Windows DNS and most proxies do, this section starts with a risk-by-team heatmap: how many tools each team reached at each risk level, with the number of people in brackets. The sample's 24 sources fall into 10 groups, from Other devices, MKT, ENG down.

Below the heatmap the most active users are listed with their number of AI tools, high-risk tools, requests and the tools they use most (the sample's most active source reached 7 tools with 188 requests). Long lists continue on further pages. If the export only has IP addresses, you get the list without the team chart; if it has no source column at all, the section is left out.

Every AI tool we found

One row per tool, sorted by number of requests. This is the page auditors ask for. The sample's 37 tools take 2 pages. The columns:

The CSV that comes with a full report has the same rows with all 13 factors, the matched hostnames and the date each vendor's terms were last checked.

Your action plan

The verdicts turned into three steps most teams complete in a day, based on the rules you picked (the sample uses General business). You can switch to one of 15 industry rule sets in your account and the whole report is rewritten for it.

Method and control evidence

The last page explains what was checked for each tool, how the exposure index works and what happened to your data (the export is read in memory and deleted; only the report is kept, for 90 days). It ends with a control evidence statement: a paragraph that records the source, the date, the register size (11,890 verified AI tools at the time of the sample) and the result, written so it can go straight into an audit file.