The Shadow AI Trilogy
Three interconnected guides that form the complete playbook for discovering, classifying, and governing unscoped AI systems in enterprise environments.
How to Detect Shadow AI
Step-by-step technical methods to identify unscoped AI systems in enterprise networks. DNS rules, SIEM queries, and behavioral detection patterns.
How to Classify AI Systems Under EU AI Act
Framework for determining if your AI systems are High-Risk, General-Purpose, or Low-Risk under EU AI Act Annex III. Includes all 37 categories.
Shadow AI Governance Checklist
8-phase checklist for implementing AI governance from discovery to compliance readiness. 70+ checkboxes, RACI matrix, and incident response planning.
How It Works
The trilogy is designed as a progressive workflow. Start with detection, move to classification, and implement governance. Each guide builds on the previous one.
Implementation Timeline
From discovery to regulatory compliance readiness typically takes 4-6 months.
Month 1-2
Detection & Discovery
Implement SIEM rules, identify shadow AI systems, document findings
Month 2-3
Classification & Assessment
Determine risk level, identify High-Risk systems, legal review
Month 3-5
Governance Implementation
Audit trail, policy enforcement, monitoring setup, bias testing
Month 5-6
Readiness & Sign-Off
Documentation complete, compliance sign-off, incident response ready
Get Started Now
↳ Ready to Govern?
Need Implementation Support?
Kyde provides end-to-end AI governance infrastructure. We automate the audit trail, policy enforcement, and compliance monitoring across all three phases.
Frequently Asked Questions
How long does it take to read all three guides?
Approximately 90 minutes combined. Detection (25 min), Classification (30 min), Governance (35 min). You can read them sequentially or focus on specific guides based on your current phase.
Do I need to follow all three in order?
Yes, conceptually. Detection → Classification → Governance is the natural workflow. However, if you already know you have High-Risk AI systems, you can start with classification and governance.
What if I'm already using AI systems?
Start with classification. Determine which systems are High-Risk under EU AI Act. Then use the governance checklist to implement compliance controls retroactively.
Are these guides applicable outside the EU?
The guides focus on EU AI Act, but the principles apply to similar regulations (DORA, NIS2, GDPR). Many principles also align with regulatory frameworks in other jurisdictions.