Key takeaways
- CIS Safeguard 2.1 calls for a software inventory reviewed bi-annually or more often, and Safeguard 2.3 calls for a monthly review of unauthorized software.
- Microsoft 365 and Google Workspace both list third-party apps users have connected to their work accounts.
- Card statements, browser extension lists and a no-blame staff survey find AI tools that sign-in logs miss.
- Paid shadow AI detection tools from Microsoft, including Defender for Cloud Apps, Entra Global Secure Access and a Microsoft 365 admin center preview, add continuous monitoring but each needs specific licenses.
- California's reasonable security statute defines covered businesses to include groups not organized to operate at a profit.
- Requiring admin approval for new app connections stops the inventory from going stale.
Why does a nonprofit need to know which AI apps staff use?
A nonprofit needs to know which AI apps staff use because each one is another place donor, client and program data can go, and you cannot set rules for tools you cannot see. If a funder, grant agreement or government data-sharing agreement asks how you protect that data, an AI tool nobody approved is a gap you cannot explain. Shadow AI detection is how you close it.
The security frameworks nonprofits already lean on start with the same step. CIS Controls v8.1 Safeguard 2.1 calls for a detailed software inventory reviewed bi-annually or more often, and Safeguard 2.3 says unauthorized software should be removed from use or given a documented exception, reviewed monthly. Both sit in Implementation Group 1, the baseline CIS sets for small organizations. Our guide to CIS Controls 1 and 2 covers the inventory in more detail. CIS has also published an AI and large language model companion guide (April 2026) that maps its safeguards to AI use.
There is a legal angle in California too. Civil Code section 1798.81.5 requires businesses that own or license certain personal information about California residents to maintain reasonable security, and section 1798.80(a) defines a business to include groups organized "whether or not" to operate at a profit. The Attorney General's 2016 Data Breach Report recommended the CIS Controls as the start of a comprehensive security program and said failing to adopt them would indicate a failure to provide reasonable security. Ask counsel how this applies to your data, but an inventory is the first piece of any reasonable security program.
What counts as shadow AI?
Shadow AI is any AI tool used for work without the organization's approval or oversight. It is broader than people pasting text into a chatbot. Common forms include:
- Chatbots used on personal accounts for grant drafts, donor letters or case notes.
- AI features switched on inside software you already approved, such as a CRM or design tool.
- Browser extensions that read the pages and documents a user has open.
- Meeting notetakers that join video calls and keep recordings and transcripts.
- Apps a user connected to their work account with a "Sign in with Microsoft" or "Sign in with Google" button, granting access to email, files or calendars.
How do you detect shadow AI without buying new software?
You can detect most shadow AI with the sign-in and consent records your email platform already keeps, plus spending, device and network data. Each source catches something the others miss.
- Microsoft 365: in the Entra admin center, go to Enterprise apps, then All applications, and open an app's Permissions page to see admin and user consent grants. Look for AI notetakers, writing assistants and chat tools.
- Google Workspace: in the Admin console, go to Security, Access and data control, API controls, then Manage App Access and the Accessed apps list. It shows how many users connected each app and which Google services it can reach.
- Card statements and expense reports: search for AI subscriptions charged to organization cards or submitted for reimbursement.
- Calendars: AI notetakers often appear as an extra attendee on recurring meetings.
- Device management: pull the list of installed browser extensions and desktop apps from your endpoint tools.
- Web filter or DNS logs: if you have them, search for traffic to well-known AI domains.
- People: send a short, no-blame survey asking which AI tools staff and volunteers use and for what. You will learn about tools no log shows, such as personal phones.
What do shadow AI detection tools add?
Paid shadow AI detection tools add continuous visibility and alerts, so discovery stops being a one-time project. Microsoft Defender for Cloud Apps lets admins filter its cloud app catalog to the Generative AI category, review each app's risk score and tag apps as sanctioned or unsanctioned. Microsoft Entra Global Secure Access offers Shadow AI discovery, which shows which users reach each AI app, how often and how much data is sent. As of October 2026, the Microsoft 365 admin center also has a Shadow AI page in Frontier preview that detects desktop AI agents on devices. It requires Microsoft 365 E5 and Microsoft Defender for Endpoint. Microsoft Purview adds browser and endpoint data loss prevention that can detect sensitive information pasted or uploaded into AI sites. Licensing differs by product, so confirm what your nonprofit plan includes before you count on any of them.
How do you run the discovery step by step?
Give it an owner, a two-week window and a simple spreadsheet.
- Name an owner, usually the operations director or whoever manages IT, and tell staff why you are doing this.
- Export the consent and connected-app lists from Microsoft 365 or Google Workspace.
- Search the last 12 months of card and reimbursement data for AI subscriptions.
- Pull browser extension and installed app lists from managed devices.
- Check web filter or DNS logs for AI sites, if you have them.
- Send the no-blame survey and promise that early answers will not be held against anyone.
- Build one inventory with a row per tool: name, users, data it touches, personal or organization account, plan terms and a decision.
- Decide for each tool: approve it, replace it with an approved option, or block it. Record any exception, as CIS Safeguard 2.3 describes.
- Tighten the front door by requiring admin approval for new app consents in Microsoft Entra or by restricting untrusted apps in Google Workspace.
- Repeat the check monthly, and turn on alerts for newly discovered apps if your tools support it.
How do you prevent shadow AI after you find it?
Prevent it by giving staff an approved option, deciding on every tool you found and telling people the outcome quickly, so no one is left guessing. Approve tools that run on an organization account with terms that bar training on your data. Replace personal-account use with that approved option, then block what remains. Thank the people who disclosed tools early, because the survey only works if staff trust it next time.
What should a nonprofit do this quarter?
- Run the two-week discovery and build the inventory.
- Choose one approved AI tool for general staff use on an organization account.
- Require admin approval for new third-party app connections.
- Publish a short list of data that never goes into any AI tool, such as client case notes, health details and donor payment information.
- Set a monthly reminder to review new apps and the exception list.
How s90 helps
s90 turns this from a one-time project into a standing control. Our new-app alerts flag AI tools the first time someone connects or signs up with an organization account, and our AI guardrails block unapproved AI sites and keep sensitive data out of approved ones. If you would like help running a first discovery pass, we are happy to talk it through.
