AIBtLAI Beyond the Laptop

FREE 10-MINUTE CHECK

Can your current AI controls see beyond the company laptop?

Run a free, 10-minute shadow AI risk check for your organisation. Answer ten practical questions about personal devices, personal AI accounts and unmanaged AI use to identify potential gaps in your existing controls. Designed for UK IT and cyber teams, this is an initial risk-screening exercise, not a formal compliance assessment or maturity score.

Answer each one as Covered, Exposed or Unknown.

Nothing is submitted. Your answers stay in this browser.

THE CHECK

Do you know the answer — or are you assuming?

“Unknown” matters. If a control exists but you cannot show that it covers the scenario, treat it as unknown for this exercise.

What does this free shadow AI risk check cover?

It explores personal ChatGPT, Claude or Gemini accounts used for work, sensitive information shared with AI tools, personal phones photographing company screens, meeting recordings, and gaps in AI rules, approvals and incident reporting.

01 Personal phones photographing company screens

Do you have a clear control or rule covering employees photographing company information and using that image with an AI tool on a personal device?

02 Personal AI accounts

Can you identify or govern the use of personal ChatGPT, Claude, Gemini or similar accounts when company information is involved?

03 Meeting recordings

Is there a clear rule for recording meetings on personal devices and uploading audio or transcripts to AI tools?

04 Copying information across environments

Do your controls address company information being copied from managed systems into an unmanaged AI session on another device?

05 Sensitive data categories

Have you made it clear which kinds of company, customer, employee or commercially sensitive information must not be placed into unmanaged AI tools?

06 Approved versus unapproved AI

Can staff easily tell the difference between approved corporate AI use and personal or unapproved AI use?

07 Exceptions and named use

Is there a practical route for staff to declare or seek approval for AI use that falls outside your normal rules?

08 Incident reporting

If someone realises they have put sensitive information into an unmanaged AI tool, do they know how to report it quickly?

09 Ownership

Is there a named owner for deciding what happens when unmanaged AI use is found — IT, cyber, data protection, HR or another role?

10 Evidence, not assumption

Could you show leadership what controls exist today for personal-device and off-network AI use, rather than simply saying that your endpoint controls are strong?