Last updated: March 26, 2026
What Is Shadow AI?
Shadow AI is the use of artificial intelligence tools and services by employees without the knowledge, approval, or oversight of their organization’s IT or security teams. It includes any AI-powered application — from browser-based chatbots to AI coding assistants to embedded AI features in SaaS products — that operates outside the organization’s AI governance framework.
If you’ve heard of shadow IT, shadow AI is its faster, more dangerous successor. While shadow IT typically involves unauthorized SaaS subscriptions or personal devices, shadow AI introduces a fundamentally different risk profile: every interaction with an ungoverned AI tool is a potential data exfiltration event. An employee pasting proprietary code into ChatGPT via a personal account isn’t just using unauthorized software — they may be training a third-party model on your intellectual property.
The scale of the problem is staggering. According to Gartner’s 2025 predictions, more than 40% of organizations will suffer shadow AI security incidents by 2030. IBM’s 2025 Cost of a Data Breach Report found that only 37% of organizations have policies to manage AI or detect shadow AI — meaning nearly two-thirds of enterprises are flying blind.
This guide walks you through what shadow AI looks like in practice, the specific risks it creates, how to run a shadow AI audit, and how to build a governance program that balances security with innovation.
How Does Shadow AI Differ from Shadow IT?
Shadow AI is not simply a new category of shadow IT — it demands a different governance approach because the risk mechanics are fundamentally different. Shadow IT refers to the use of unauthorized software, hardware, or cloud services outside IT oversight. Shadow AI amplifies every shadow IT risk and adds entirely new ones.
| Dimension | Shadow IT | Shadow AI |
|---|---|---|
| Primary risk | Data stored in unapproved locations | Data actively sent to third-party models for processing |
| Data exposure model | Static — data sits in an app | Dynamic — data is transmitted on every prompt |
| IP risk | Data may be accessible to vendor | Data may be used to train models, becoming irrecoverable |
| Output risk | Limited — tools produce what users input | High — AI generates content that may contain hallucinations, bias, or compliance violations |
| Detection difficulty | Moderate — trackable via SSO, procurement, network | Hard — browser-based, often uses personal accounts, no procurement trail |
| Regulatory exposure | Data residency, vendor contracts | EU AI Act inventory requirements, GDPR Art. 22 automated decision-making, sector-specific AI rules |
| Growth rate | Linear (one tool at a time) | Exponential (AI features embedding in existing tools) |
Key takeaway: The critical difference is the output risk. When an employee uses an unauthorized spreadsheet app, the worst case is data leakage. When an employee uses an unauthorized AI tool to draft customer communications, generate legal analysis, or write code, the outputs themselves become a risk vector — potentially containing hallucinated facts, biased recommendations, or compliance violations that the organization never gets a chance to review.
How Big Is the Shadow AI Problem?
Shadow AI is already pervasive across every industry, growing at double-digit rates, and costing organizations hundreds of thousands of dollars in additional breach costs. Here is what the data shows as of early 2026.
Prevalence
- 78% of AI users bring their own AI tools to work rather than using employer-provided tools, according to the Microsoft 2025 Work Trend Index
- 68% of enterprise employees who use generative AI access it through personal accounts outside IT oversight, per Menlo Security’s 2025 report
- 91% of AI tools in the enterprise operate outside IT control, with organizations averaging 269 shadow AI applications per 1,000 employees (Reco 2025 State of Shadow AI Report)
- 57% of employees using shadow AI tools admit to entering sensitive or confidential company data (Menlo Security 2025)
Financial Impact
- Organizations with high levels of shadow AI face $670,000 in additional breach costs compared to those with low or no shadow AI (IBM 2025 Cost of a Data Breach Report)
- Insider risk incidents — now amplified by shadow AI — cost organizations an average of $19.5 million per year, up 20% since 2023 (DTEX/Ponemon 2026 Cost of Insider Risks Report)
- 63% of breached organizations either don’t have an AI governance policy or are still developing one (IBM 2025)
Growth Trajectory
- Enterprise web traffic to generative AI sites jumped 50% from 7 billion visits in February 2024 to 10.53 billion in January 2025 (Menlo Security 2025)
- Netskope now tracks over 1,550 distinct generative AI SaaS applications, up from just 317 in February 2024 (Netskope Cloud and Threat Report 2025)
- 60% of employees are predicted to use their own AI tools at work, spawning a “bring your own AI” (BYOAI) wave that outpaces governance (Forrester 2024 Predictions)
What Are the 5 Categories of Shadow AI?
Shadow AI is not a monolith. There are 5 primary categories of shadow AI in the enterprise, each with distinct risk profiles and detection methods:
1. Browser-Based Generative AI
Browser-based generative AI refers to web-based AI assistants like ChatGPT, Claude, Gemini, or Perplexity accessed through personal accounts or free tiers. These tools process every prompt server-side. Employees pasting customer data, source code, financial projections, or legal documents into a chat window are sending that data to a third-party provider — often with no contractual safeguards, data processing agreements, or retention controls.
ChatGPT alone accounts for 53% of all shadow AI activity in enterprise environments according to Reco’s research.
2. AI Coding Assistants
AI coding assistants are tools like GitHub Copilot, Cursor, Cody, or Amazon CodeWhisperer that developers use without organizational approval to autocomplete code, generate functions, and suggest fixes — often processing the codebase they’re embedded in.
Code completion tools can inadvertently expose proprietary algorithms, send code snippets to external servers for processing, or introduce insecure code patterns without review. If the AI assistant generates code that contains vulnerabilities or license-infringing patterns, the organization bears the liability. AI coding assistants are among the fastest-growing categories of shadow AI, with adoption accelerating across engineering teams who view them as essential productivity tools.
3. Browser Extensions with AI Features
AI-powered browser extensions are grammar checkers, email assistants, meeting summarizers, and productivity tools that incorporate AI capabilities, often routing content through external AI services.
Browser extensions have broad permissions — they can read page content, access email bodies, and monitor browsing activity. When these extensions route content through AI services, they can capture data from any web application the employee uses, including internal tools, CRM systems, and confidential documents. An increasing number of extensions now include AI-powered features — many added silently through automatic updates to previously non-AI tools.
4. Unauthorized API Integrations
Unauthorized API integrations are direct connections from internal workflows to AI APIs (OpenAI, Anthropic, Google) built by developers and power users using personal API keys in Slack bots, spreadsheets, or automation tools.
These integrations bypass all security controls — there’s no DLP, no access logging, no cost tracking, and no policy enforcement. Data flows directly from internal systems to external AI providers through channels that are invisible to IT. As AI APIs become easier to use, technically skilled employees build custom integrations in hours. These are nearly impossible to detect through traditional network monitoring because they use standard HTTPS traffic. For organizations using LLM guardrails on their official AI systems, shadow API integrations represent a complete bypass of those protections.
5. AI-Native SaaS Features
AI-native SaaS features are AI capabilities embedded in already-approved tools (CRM, project management, design, analytics) through automatic updates — bypassing normal software procurement and security review entirely.
This is the fastest-growing and hardest-to-detect category. Gartner predicts that by 2026, 70% of employee interactions with AI will occur through features embedded in existing SaaS applications — making this the dominant vector for shadow AI going forward. The AI features may process data differently than the base application — often sending it to a different third-party AI provider.
What Are the 5 Risk Categories of Shadow AI?
Not all shadow AI risks are equal. There are 5 distinct risk categories that organizations must assess to prioritize their governance response:
| Risk Category | Description | Severity | Affected Stakeholders | Example Scenario |
|---|---|---|---|---|
| Data Leakage | Confidential data sent to unvetted AI providers | Critical | CISO, DPO, Legal | Engineer pastes database schema with customer PII into ChatGPT to debug a query |
| Compliance Violations | AI usage that violates regulatory requirements (GDPR, EU AI Act, HIPAA, SOC 2) | Critical | Compliance, Legal, CISO | HR team uses AI tool for resume screening without required bias audit under EU AI Act |
| IP Exposure | Proprietary code, algorithms, trade secrets, or business strategy exposed to AI training data | High | CTO, Legal, CEO | Developer uses personal Copilot account on proprietary codebase; code snippets appear in other users’ completions |
| Quality & Hallucination Risk | AI-generated outputs contain inaccurate, biased, or fabricated information used in business decisions | High | CTO, Compliance, Business Leaders | Financial analyst uses AI to generate a market analysis for the board; report contains hallucinated statistics |
| Cost Sprawl | Untracked AI spend across personal subscriptions, API keys, and embedded SaaS features | Medium | CFO, CTO, Procurement | 200 employees each spend $20/month on ChatGPT Plus; $48,000/year in untracked AI spend with no volume licensing |
graph TD
A[Shadow AI Risk Assessment] --> B{Data Classification}
B -->|Confidential/PII| C[Critical Risk]
B -->|Internal/Proprietary| D[High Risk]
B -->|Public/Non-sensitive| E[Medium Risk]
C --> F[Immediate Block + DLP]
D --> G[Policy Enforcement + Monitoring]
E --> H[Approve with Guardrails]
F --> I[Investigate & Remediate]
G --> I
H --> I
I --> J[Ongoing Governance]Figure: Shadow AI risk assessment decision flow based on data classification.
How Do You Run a Shadow AI Audit?
A shadow AI audit is a systematic process for discovering and inventorying all AI tools in use across an organization, including those operating without IT approval. The goal is discovery — building a complete inventory before you can govern them. There are 6 steps in a thorough shadow AI audit:
Step 1: Network Traffic Analysis
What to do: Monitor DNS queries and outbound HTTPS traffic for connections to known AI provider domains.
Key domains to monitor:
api.openai.com,chat.openai.comapi.anthropic.com,claude.aigenerativelanguage.googleapis.com,gemini.google.comapi.perplexity.ai,api.cohere.aicopilot.github.com,api.github.com/copilot
What you’ll find: Volume of AI traffic, which teams and endpoints are generating it, and the frequency of usage. This won’t reveal what data is being sent, but it establishes the scope of the problem.
Tool requirements: DNS monitoring, web proxy logs, or a next-gen firewall with application awareness.
Step 2: SSO and Identity Provider Logs
What to do: Audit your identity provider (Okta, Azure AD, Google Workspace) for OAuth grants and SAML authentications to AI services. Many employees sign up for AI tools using corporate SSO without IT approval.
What to look for:
- OAuth consent grants to AI-related applications
- SAML/OIDC authentication events for AI provider domains
- API token issuance patterns
What you’ll find: A list of AI applications that employees have authenticated with using corporate credentials — even if no one in IT approved them.
Step 3: Endpoint and Browser Scanning
What to do: Use endpoint management tools to inventory installed applications and browser extensions across corporate devices.
What to look for:
- Desktop AI applications (local LLM tools, AI coding assistants)
- Browser extensions with AI capabilities (grammar assistants, summarizers, translation tools)
- MCP (Model Context Protocol) servers and local AI configurations
What you’ll find: AI tools running on endpoints that don’t generate network traffic to cloud providers — including local LLMs and browser extensions that process data through embedded AI.
Step 4: Cloud Billing and Procurement Review
What to do: Audit cloud provider invoices (AWS, Azure, GCP) for AI service charges, and review expense reports and corporate card transactions for AI subscription payments.
What to look for:
- AWS Bedrock, SageMaker, or Comprehend charges
- Azure OpenAI Service or Cognitive Services billing
- GCP Vertex AI or Gemini API costs
- Expense reimbursements for AI subscriptions ($20/month ChatGPT Plus, $200/month Claude Pro, etc.)
What you’ll find: Official and unofficial AI spend that never went through procurement, including team-level API accounts with live billing.
Step 5: Browser Extension Audit
What to do: Specifically enumerate browser extensions across your fleet, as these are the most commonly overlooked shadow AI vector.
What to look for: Extensions requesting permissions to read page content, access clipboard, or communicate with external services. Cross-reference with known AI extension databases.
What you’ll find: AI-powered extensions embedded in employees’ browsers that silently process content from every web application they use — including internal tools.
Step 6: Employee Surveys and Interviews
What to do: Conduct anonymous surveys asking employees what AI tools they use, how often, and for what purposes. Complement with targeted interviews of team leads.
Why this matters: Technical scanning catches tools, but surveys catch context. You’ll learn why employees adopted shadow AI tools — usually because sanctioned alternatives are too slow, too restricted, or don’t exist. This insight is critical for designing a governance program that employees will actually follow.
Sample questions:
- Which AI tools do you use for work tasks? (list common options + free text)
- How often do you use AI tools that are not officially provided by the company?
- What types of data do you typically input into AI tools?
- What would you need from an officially sanctioned AI tool to stop using personal alternatives?
graph LR
A[Network<br/>Traffic Analysis] --> G[Shadow AI<br/>Inventory]
B[SSO & IdP<br/>Log Audit] --> G
C[Endpoint &<br/>Browser Scan] --> G
D[Cloud Billing<br/>Review] --> G
E[Browser Extension<br/>Audit] --> G
F[Employee<br/>Surveys] --> G
G --> H[Risk<br/>Assessment]
H --> I[Governance<br/>Policy]
I --> J[Tool Selection<br/>& Deployment]
J --> K[Ongoing<br/>Monitoring]Figure: The shadow AI audit pipeline — from discovery through ongoing governance.
How Do You Move from Audit to Governance?
Discovering shadow AI is only the beginning. The audit findings must drive a governance program that reduces risk without killing productivity. There are 4 phases in building a shadow AI governance program:
Phase 1: Policy (Weeks 1-2)
Define clear, enforceable policies based on your audit findings.
Essential policies to establish:
-
Acceptable AI Use Policy: Which AI tools are approved, for which tasks, and with what data classifications. Be specific — “do not use AI with confidential data” is unenforceable. “Do not paste customer PII, source code, or financial projections into any AI tool not on the approved list” is actionable.
-
AI Tool Procurement Process: How teams request and get approval for new AI tools. If this process takes 6 months, employees will continue using shadow AI. Target 2-week approval for standard requests.
-
Data Classification for AI: Extend your existing data classification scheme to specify which categories can and cannot be used with AI tools. Most organizations need a new tier: “AI-permitted” data that can be processed by approved AI tools under specific conditions.
-
Incident Response Procedures: What happens when shadow AI usage is detected? Punitive-only approaches fail. Combine education with escalation paths.
Regulatory alignment: Ensure your AI policy addresses EU AI Act Article 4 (AI literacy requirements) and Article 26 (obligations for deployers of high-risk AI systems), as well as NIST AI RMF governance functions (GOVERN 1.1-1.7). Our EU AI Act compliance checklist covers the specific obligations relevant to shadow AI governance.
Phase 2: Tooling (Weeks 3-6)
Provide sanctioned alternatives that are genuinely better than the shadow AI tools your employees adopted. If your approved tools are worse than ChatGPT free tier, your policy will fail.
What to deploy:
- Enterprise AI platforms with SSO, audit logging, DLP, and data residency controls
- AI coding assistants with organizational code policies and IP protections
- API gateways that let developers use AI APIs through a governed, monitored proxy rather than personal keys — a transparent proxy approach eliminates shadow API usage by routing all LLM traffic through governed pipelines
- Pre-approved browser extensions with managed deployment via your endpoint management tools
Bottom line: The governed alternatives must be at least as easy to use as the shadow tools. Friction is the enemy of compliance.
Phase 3: Monitoring (Weeks 4-8)
Deploy continuous monitoring to detect new shadow AI adoption and enforce policies on governed tools.
Monitoring capabilities to implement:
- Network-level AI traffic monitoring: DNS and proxy-based detection of connections to AI services
- DLP for AI interactions: Content inspection on outbound requests to AI providers to detect sensitive data
- Browser extension management: Automated inventory and policy enforcement for extensions
- Cost tracking: Centralized visibility into AI spend across approved and discovered tools
- Usage analytics: Understanding who uses what, how often, and for what purposes
Phase 4: Enforcement (Ongoing)
Enforcement is where governance becomes real. There are 4 graduated enforcement levels that organizations should implement:
Graduated enforcement model:
| Level | Action | When to Use |
|---|---|---|
| Educate | Notify the user that their tool isn’t approved and point them to the sanctioned alternative | First-time detection of low-risk shadow AI |
| Warn | Formal warning with documentation; manager notified | Repeat usage or moderate-risk data exposure |
| Redirect | Automatically redirect AI traffic through the governance proxy | Where technically feasible (transparent proxy deployment) |
| Block | Block access to unapproved AI tools at the network or endpoint level | Persistent policy violations or high-risk data exposure |
Key takeaway: The most effective approach combines technical controls with cultural change. Organizations that treat shadow AI as purely a security problem miss the underlying signal: employees adopted AI because it makes them more productive. The governance program must preserve that productivity gain.
What Does Shadow AI Governance Look Like in Practice?
At TruthVouch, we approach shadow AI governance as a spectrum — from initial awareness through continuous enforcement.
For initial assessment: TruthVouch offers a free, no-login-required Shadow AI Assessment that scores your organization’s exposure across key governance dimensions in about 5 minutes. This questionnaire-based maturity assessment evaluates your current policies, visibility, and controls to identify gaps — giving you a prioritized starting point for your governance program.
For ongoing enforcement: The Sentinel desktop agent provides transparent proxy-based AI traffic monitoring with DLP and policy controls. Sentinel intercepts AI API traffic at the workstation level, enforcing policies before data leaves the device. It supports 3 inspection modes — observe (log only), scan (policy check), and full (deep content inspection) — so you can graduate enforcement as your program matures. Fleet management capabilities let you deploy, monitor, and update agents across your organization from a central dashboard.
For network-level discovery: The Discovery Agent monitors DNS queries, API gateway traffic, cloud billing, and SSO events to continuously identify new AI tools entering your environment — catching shadow AI that individual endpoint agents might miss. Organizations using autonomous governance agents can automate the response workflow, from detection through remediation.
Which Regulations Require Shadow AI Governance?
Shadow AI isn’t just a security concern — it’s rapidly becoming a compliance obligation under multiple regulatory frameworks. Here are the 4 key frameworks that mandate AI inventory and governance:
EU AI Act (effective August 2, 2026): Article 4 requires organizations to ensure AI literacy among staff. Article 26 places specific obligations on deployers of high-risk AI systems, including maintaining logs and monitoring operations. Organizations that cannot inventory their AI systems cannot demonstrate compliance. Penalties reach up to EUR 35 million or 7% of global annual turnover for the most serious violations.
NIST AI Risk Management Framework: The GOVERN function (specifically GOVERN 1.1 through 1.7) establishes that organizations must have policies, processes, and procedures to map, measure, and manage AI risks — which requires a complete inventory of AI systems, including unauthorized ones.
ISO/IEC 42001:2023: The AI management system standard requires organizations to determine the scope of their AI management system, including identifying all AI systems within the organization. Shadow AI is, by definition, outside this scope — creating an automatic nonconformity.
SOC 2: Shadow AI directly impacts the Security, Availability, and Confidentiality trust services criteria. Auditors are increasingly asking about AI governance as part of SOC 2 examinations.
Bottom line: Organizations that haven’t addressed shadow AI by the time these frameworks are actively enforced face both regulatory penalties and audit failures. The compliance automation landscape is evolving to help organizations track these obligations across multiple frameworks simultaneously.
Shadow AI Governance Maturity: How to Assess Your Readiness
Shadow AI governance maturity refers to the degree to which an organization has implemented systematic processes for discovering, managing, and controlling unauthorized AI usage. Use this checklist to assess your current maturity level and track progress.
| Maturity Level | Characteristics | Typical Shadow AI Exposure |
|---|---|---|
| Level 1: Ad Hoc | No formal AI policy, no monitoring, no inventory | Unknown — could be 50-500+ shadow AI tools |
| Level 2: Awareness | Basic AI policy exists, but no enforcement or monitoring | Partially known — policy-compliant employees self-report |
| Level 3: Managed | Network monitoring active, sanctioned tools deployed, quarterly audits | Mostly known — continuous discovery catching 70-80% of tools |
| Level 4: Governed | Real-time monitoring, automated enforcement, integrated compliance reporting | Well-controlled — <10% of AI usage is unsanctioned |
| Level 5: Optimized | AI governance fully integrated into IT operations, continuous improvement, predictive risk scoring | Minimal — shadow AI detected and addressed within hours |
Discovery Phase:
- Completed network traffic analysis for AI provider domains
- Audited SSO/IdP logs for unauthorized AI tool authentications
- Scanned endpoints for AI applications and browser extensions
- Reviewed cloud billing for AI service charges
- Surveyed employees on AI tool usage
- Built a complete shadow AI inventory with risk classification
Policy Phase:
- Published an acceptable AI use policy
- Established an AI tool procurement fast-track process
- Updated data classification to include AI-specific tiers
- Defined incident response procedures for shadow AI discovery
- Aligned policies with EU AI Act, NIST AI RMF, or applicable regulations
Tooling Phase:
- Deployed sanctioned AI platform(s) with enterprise controls
- Provided approved AI coding assistant(s) for engineering teams
- Set up governed API gateway for developer AI usage
- Migrated top shadow AI use cases to sanctioned alternatives
Monitoring & Enforcement Phase:
- Deployed continuous AI traffic monitoring
- Implemented DLP for outbound AI interactions
- Established browser extension management policies
- Activated centralized AI cost tracking
- Implemented graduated enforcement (educate, warn, redirect, block)
Organizations at Level 1 or 2 should begin with the TruthVouch AI Advisor assessment, which scores your maturity across 5 governance dimensions and provides a personalized remediation roadmap.
Frequently Asked Questions
Should we just block all AI tools?
No. Blocking all AI is counterproductive and ultimately futile. Employees adopted AI tools because they provide genuine productivity gains — Microsoft’s research shows that 78% of AI users bring their own tools to work. If you block all AI, employees will find workarounds (personal devices, mobile hotspots) that are even harder to monitor. The goal is to channel AI usage through governed pathways, not eliminate it.
How often should we run a shadow AI audit?
Initial audits should be comprehensive (all 6 steps described above). After that, continuous monitoring replaces periodic audits for most categories. However, conduct a full re-audit quarterly, because the AI tool landscape changes rapidly — Netskope found the number of GenAI SaaS apps grew from 317 to over 1,550 in just 11 months. The quarterly audit catches what continuous monitoring misses, particularly new categories of AI-native SaaS features.
What is the biggest mistake organizations make with shadow AI governance?
Treating it as purely a security problem is the most common failure. The typical failure mode is: security team blocks AI tools, employees feel frustrated and unheard, employees find workarounds, and the cycle repeats. The most effective programs involve IT, security, legal, HR, and business leaders in designing policies that protect the organization while enabling the productivity gains that drove shadow AI adoption in the first place.
How does shadow AI affect SOC 2 or ISO 27001 audits?
Shadow AI creates direct gaps in your control environment. For SOC 2, it impacts the Security and Confidentiality trust service criteria — you can’t demonstrate control over data if you don’t know where it’s going. For ISO 27001, shadow AI represents unidentified information assets and uncontrolled data flows, both of which are audit findings. Auditors are increasingly including AI governance in their testing procedures.
Do small teams (under 50 people) need to worry about shadow AI?
Yes — small organizations actually face the highest risk per capita. Reco’s research found that companies with 11-50 employees have the highest rate of shadow AI usage at 27% of employees, averaging 269 shadow AI tools per 1,000 employees. Smaller teams also lack dedicated security resources, making detection and response harder. Start with a lightweight approach: employee survey, acceptable use policy, and one sanctioned AI platform.
Next Steps
Shadow AI governance is not a one-time project — it’s an ongoing operational capability. Start with assessment, move to policy, deploy tooling, and iterate.
Assess your current exposure: Take the free TruthVouch Shadow AI Assessment to score your organization’s shadow AI risk in 5 minutes. No login required.
Build your governance foundation: Read our guide to building an AI governance framework from scratch for the full 12-month roadmap from zero to mature governance.
Protect your AI outputs: Once you’ve governed AI inputs, ensure the outputs are trustworthy with hallucination detection in production.
Sources & Further Reading
- Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents by 2030 — Gartner, November 2025
- IBM 2025 Cost of a Data Breach Report — IBM/Ponemon Institute, July 2025
- Menlo Security 2025 Report: 68% Surge in Shadow Generative AI Usage — Menlo Security, August 2025
- Reco 2025 State of Shadow AI Report — Reco, 2025
- DTEX/Ponemon 2026 Cost of Insider Risks Global Report — DTEX Systems/Ponemon Institute, February 2026
- Forrester 2024 Predictions: AI Shadow Pandemic — VentureBeat/Forrester, 2024
- Microsoft 2025 Work Trend Index — Microsoft, 2025
- Netskope Cloud and Threat Report: Shadow AI and Agentic AI 2025 — Netskope, 2025
- ISACA: The Rise of Shadow AI — Auditing Unauthorized AI Tools in the Enterprise — ISACA, 2025
- EU AI Act Official Text — EUR-Lex, 2024
- NIST AI Risk Management Framework — NIST
- ISO/IEC 42001:2023 — AI Management System — ISO
- ISO/IEC 27001 — Information Security Management — ISO
Tags: