MR-062 Governance & process Organization scope

Shadow AI and unsanctioned use of AI tools

Staff adopt and use AI tools or services outside sanctioned channels, so the deployer cannot inventory, secure, assess, or govern systems it does not know are in use.

Risk family: Governance & process
MIT domain: n/a (ISO-derived)
MIT subdomain: n/a
AI type: GPAI, Agentic, Classical_ML
Scope: Organization
Source standard: ISO/IEC 23894 + 42001 (gap analysis)

Provenance

Source standard

ISO/IEC 23894 + 42001 (gap analysis)

Source frameworks

ISO/IEC 42001:2023

ISO/IEC references

42001 Annex A, A.2.2 and A.9.2

Nearest MIT-derived risk

MR-043 Inadequate AI governance and oversight: related but generic; it does not name the specific exposure of untracked, unsanctioned tool adoption by staff.

Framework crosswalk

Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.

Sourcesframeworks that contributed to the register

ISO 420012

A.2.2 ISO/IEC 42001 Annex A A.2.2
A.9.2 ISO/IEC 42001 Annex A A.9.2

More in Governance & process

MR-037 MR-042 MR-043 MR-045 MR-046 MR-054 MR-063 MR-066 MR-067 MR-068 MR-069 MR-070

Part of the Deployer AI Risk Register, an open-source resource developed by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.