SERVICE / THIRD RAIL AI
Someone in your business is already using AI you don't know about.
"Shadow AI" is what we call the AI tools employees adopt on their own — a free chatbot to summarise a client email, a browser plugin that drafts contracts, a personal account used for company documents. It happens in almost every business, and almost none of them have looked. Third Rail AI is our audit and governance practice: we find where AI is already touching your business, work out what it's doing with your data, and help you build a policy that people will actually follow instead of ignoring.
The method isn't compliance box-ticking. Discovery and data-exposure review are investigative work — the same OSINT, CYBINT, and SIGINT discipline used to find out what's actually happening, not what's supposed to be happening.
What a Shadow AI Audit covers
- Discovery — identifying AI tools and services in active use across your organisation, sanctioned or not
- Data exposure review — what company or client data is being sent to third-party AI systems, and under what terms
- Risk mapping — where AI use creates legal, contractual, confidentiality, or compliance exposure
- Policy design — a usage policy your team can actually work within, not a document nobody reads
- Monitoring recommendations — practical ways to keep visibility on AI use going forward, without micromanaging your own staff
Who this is for
Businesses handling client data, regulated information, or intellectual property, where "someone pasted it into ChatGPT" is a genuine risk nobody's assessed yet.
This isn't about banning AI. It's about knowing what's already happening, before a client or a regulator finds out before you do.