Shadow AI Defence · AIRAS Cloud 2.0.0

Find the AI nobody approved. Govern it properly.

Seven governed steps from authorised evidence to a human decision. Metadata only, signed reports, tenant isolation and a tamper-evident record throughout.

Detection confidence ≠ regulatory classification ≠ operational risk

Workflow · checked 24 October 2026

From overlooked AI to an accountable decision

Organisation
01
Authorised evidence
Upload material within the agreed scope.
Contracts and vendor specifications · architecture and integration records · project documents and DPIAs.
Scope and sources remain explicit.
AIRAS Discovery
02
Identify potential AI
Extract text and preserve its source. Analyse purpose and supporting signals.
Candidate finding: source excerpt, confidence and rationale, missing facts made visible.
Human review
03
Verify actual use
Check the feature, activation, purpose and deployment facts.
Need evidence keeps review open. Dismissal retains the reason.
Confirm with a named owner.
Governance handoff
04
Register and define context
Create or link the governed record. Record use, data and integrations.
Assign accountable owners and complete the assessment inputs.
Confirmation is not approval to use.
Assessment in AIRAS
05
Regulatory rules and ARIE
Regulatory: AI qualification, role, prohibitions, classification and obligations.
ARIE: operational risk, controls and reasoning. Versioned, reproducible results.
A score cannot override a prohibition.
Authorised human decision
06
Review controls and decide
Check required controls and readiness evidence. Record the decision and conditions.
Approve with conditions · request more evidence · restrict or discontinue.
Named reviewer · rationale · conditions
07Enact the decision and maintain oversight
Responsible teams
Apply restrictions, maintain required controls and provide evidence of implementation.
AIRAS Cloud
Keeps conditions, incidents, evidence and review dates connected to the governed record. Reported changes or due reviews update the context.

One governed record

Evidence · accountable owners · assessment versions · decisions · rationale · review history

Coverage depends on authorised evidence and the review performed. Responsible teams implement technical restrictions.

Not a concept

Built. Implemented. Tested in-house.

Shadow AI Defence ships as part of AIRAS Cloud 2.0.0 with its own isolated data, its own safeguards and its own test suite, checked by our QA team.

Shadow AI tests: 18/18
Platform tests: 2,559/2,559

Internal QA runs, October 2026. Not an external penetration test or certification.

Metadata only
No prompts, emails, browsing history or source code are collected.
Signed reports
Every incoming report is signed and checked. Stale or tampered reports are refused.
No replays
Each report can be used once only, so it cannot be replayed.
Organisations kept apart
Each organisation's data is separated from every other organisation's.
Tamper-evident audit
Every action is chained into an audit record that shows any change or removal.
Human-only handoff
Nothing enters a formal assessment unless a named person asks for it.

Customer Technical Reference · Release 2.0.0 · 24 October 2026

Every workflow documented for your IT, security and governance teams

Architecture and responsibilities
Onboarding and handover
Identity and second-factor sign-in
Document evidence and lineage
Candidate review and decisions
ARIE input and result contract
Integration API v1
Credential custody and rotation
Verifiable customer exit

Request it: book 20 minutes

Shared on request with prospective clients.

See Shadow AI Defence on your own estate.

Book 20 minutes with Richie or Amy. We will walk through the workflow, the safeguards and what a pilot looks like.

No commercial commitment. No confidential information required.