Abstract

Generative AI assistants are now being used for work purposes, often beyond the view of enterprise IT, security, and compliance functions, creating a shadowy14 area where data usage is difficult to track and responsibility hard to establish. By analyzing six different papers mentioned in the seminar synopsis together with related standards and explainability literature, this study identifies gaps in research on detection, classification of risk, and governance response. It proposes a conceptual six-step framework (Monitoring and Discovery, Context Collection, Risk Assessment, Explainability, Governance Decision, and Continuous Monitoring) which aims to turn authorized monitoring signals into context-enriched events scored using a transparent if formula with hard-rule floors and an uncertainty band, fully traceable reason codes, and proportionate response options including a specific “indeterminate” category. The study is based on conceptual design informed by a reference-driven literature review: no algorithms, datasets, or experiments have been implemented, and all weights, thresholds, and scenarios are purely illustrative. An evaluation plan is suggested, covering thematic areas of detection adequacy, classification coherence, explanation value, latency, privacy, and ablation analysis. The framework is intended to provide decision-makers with the needed context for responsible Shadow AI governance; its effectiveness still needs to be proven in practice.

Keywords

How to Cite This Article

Rights