When a regulator or insurer asks what your employees put into AI, "we don't know" is the wrong answer.
The data has been leaking for years. The audit trail to prove you governed it arrives now.
Do you block or do you govern? Both, in order: Discover, Detect, Defend. We don't just block, we show our work, and the work is the evidence a regulator or insurer asks for. Document shadow AI risk and keep a queryable audit trail for ISO 27001, HIPAA, PCI DSS, SOC 2, and FISMA. See how we handle the data behind that evidence.
Download the Compliance Mapping Guide
Audit readiness
When the auditor asks about AI governance, you'll have the answer
Regulators, insurers, and boards are already asking these questions. The question isn't whether you'll be asked. It's whether you'll have evidence.
"Which AI tools are employees using?"
ShadowWatch auto-discovers every AI tool across your managed browsers, including tools not on any approved list.
"Is sensitive data being shared with AI?"
Every prompt is inspected for PII, credentials, source code, and regulated data before it reaches the AI provider.
"Can you see AI use that happens on personal accounts?"
Yes. ShadowWatch inspects prompts at the browser layer, so it catches AI interactions even when employees are logged into personal accounts on unapproved tools. That's the usage network and API-based tools can't see.
"What governance controls are in place?"
Adaptive policy enforcement: audit, warn, or block based on tool, account coverage, data sensitivity, and user role.
"Can you produce evidence of AI governance?"
A queryable audit trail logs every AI interaction with timestamps, users, tool, action taken, and auto-redacted sensitive patterns.
"How quickly can you detect a policy violation?"
Real-time. Violations trigger instant alerts to Slack, email, webhooks, or your SIEM. No batch processing or next-day reports.
Cyber Insurance
The Questions Underwriters Now Ask About AI
Insurers are adding AI-governance questions to applications, and most policies weren't written with AI in mind. ShadowWatch gives you the evidence to answer them.
Sources: IBM Cost of a Data Breach 2025; Aon AI Fact Sheet 2026; Aon/Ponemon 2026; Areebi Index Q2 2026.
| Underwriting question | How ShadowWatch answers it | Coverage |
|---|---|---|
| Do you maintain an inventory of AI tools in use? | Yes. Automatic discovery of any browser-based AI tool, including ones not on any list. | Yes |
| Can you show what sensitive data has been shared with AI? | Yes. A queryable audit trail with PII, secrets, and API keys auto-redacted. | Yes |
| How do you enforce an AI acceptable-use policy? | Partial. We enforce warn/block/log per policy, but your team authors the rules. We provide the evidence that enforcement happened. | Partial |
| Do you govern AI use inside approved SaaS apps? | Partial. At the browser layer, DOM/iframe detection covers any web SaaS app your team uses in a managed browser. | Partial |
| What is your data-retention posture for AI interactions? | Yes. Configurable 7 / 90 / 365 days by tier, exportable for underwriter review. | Yes |
| Can you detect AI-impersonation and AI-phishing risk? | Yes. The AI Presence Indicator warns before an employee trusts an AI on an unknown site, and the event is logged. | Yes |
| How quickly can you produce evidence after an incident? | Yes. Export filtered audit evidence on demand, not by re-running reports. | Yes |
Regulatory hooks
- HIPAA: Security Rule audit controls (§164.312(b)) and the HHS-proposed AI-inventory requirement map to our audit trail and automatic discovery.
- GLBA: safeguarding rules for customer financial data already prohibit leaking it into unapproved AI; our monitoring and redaction logs support the required oversight.
- SEC 8-K: material cybersecurity incident disclosure (effective late 2025); AI-driven incidents qualify, and our audit evidence supports the disclosure.
- GDPR Art. 32: ongoing review of data security; our monitoring and redaction logs provide the evidence for it.
- EU AI Act: Article 50 transparency obligations took effect August 2, 2026; standalone high-risk obligations were deferred to December 2, 2027 under the Digital Omnibus. The fine ceiling is 7% of global annual turnover. We export the evidence; we do not auto-generate framework-mapped compliance reports.
ISO 27001
Information Security Management
ISO 27001 is the international standard for information security management systems (ISMS). It provides a framework for managing sensitive information through risk assessment and continuous improvement.
How ShadowWatch Helps: ShadowWatch helps organizations meet ISO 27001 requirements by maintaining an inventory of AI tools accessed via browser, monitoring their usage, and generating audit trails for information security controls.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| A.5.23 | Information security for cloud services | Detects unsanctioned AI tools and tracks sanctioned AI usage accessed via web browsers | Partial |
| A.8.8 | Management of technical vulnerabilities | Identifies Shadow AI tools with potential security vulnerabilities and data exfiltration risks | Partial |
| A.8.15 | Logging | Maintains audit trails of browser-based AI interactions for security event analysis | Partial |
| A.8.16 | Monitoring activities | Real-time monitoring of AI tool usage in browsers with anomaly detection | Partial |
| A.8.32 | Change management | Automatically detects new AI tools entering the organization via browser access, supporting change control processes | Partial |
ISO 27701
Privacy Information Management
ISO 27701 extends ISO 27001 to establish a Privacy Information Management System (PIMS). It provides requirements for organizations acting as PII controllers or processors.
How ShadowWatch Helps: ShadowWatch supports privacy compliance by identifying what PII is being processed by AI tools in browsers and maintaining audit logs that serve as evidence of AI-related data processing.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| 7.2.1 | Identify lawful basis for processing | Shows what personal data is being processed by AI tools, supporting lawful basis documentation | Supporting |
| 7.3.2 | Processing records | Audit logs serve as evidence of browser-based AI data processing activities | Partial |
| 7.5.1 | Privacy impact assessments | Detection data feeds privacy impact assessments for AI tool usage | Partial |
ISO 42001
AI Management System
ISO 42001:2023 is the international standard for AI management systems. It specifies requirements for establishing, implementing, and improving AI governance within organizations.
How ShadowWatch Helps: ShadowWatch addresses ISO 42001 requirements for AI system monitoring, risk assessment, and impact documentation within browser-based contexts, which is the core of AI governance for web-accessed tools.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| 6.1.2 | AI risk assessment | Risk scoring and classification of AI tools accessed via browser aligns with AI-specific risk evaluation requirements | Partial |
| 8.2.1 | AI impact assessment | Monitoring data provides evidence for AI system impact documentation | Partial |
| 9.1.2 | Monitoring AI systems | Core purpose: monitors AI system usage in browsers with anomaly detection | Partial |
| A.6.3 | AI system deployment | Detects and tracks AI tools deployed or accessed via browser | Partial |
ISO 27017
Cloud Security
ISO 27017 provides cloud-specific security controls extending ISO 27002. It clarifies responsibilities between cloud service providers and customers for protecting data.
How ShadowWatch Helps: ShadowWatch monitors AI cloud service usage in browsers and maintains visibility into which cloud AI services process company and customer data.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| CLD.6.3.1 | Shared roles & responsibilities | Documents which AI services process company/customer data, clarifying responsibility boundaries | Supporting |
| CLD.12.4.5 | Monitoring of cloud services | Monitors AI cloud service usage and data flows in browsers for security visibility | Partial |
HIPAA
Health Insurance Portability and Accountability Act
HIPAA establishes national standards for protecting sensitive patient health information. The Security Rule requires administrative, physical, and technical safeguards for ePHI.
How ShadowWatch Helps: ShadowWatch helps healthcare organizations maintain HIPAA compliance by detecting PHI transmitted to unsanctioned AI tools via browser and maintaining audit trails for compliance evidence.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| § 164.312(b) | Audit controls | Maintains logs of browser-based AI interactions involving PHI | Partial |
| § 164.312(d) | Access controls | Identifies sanctioned vs. unsanctioned AI tool usage to inform access policy enforcement | Supporting |
| § 164.312(e)(1) | Transmission security | Detects PHI transmitted to unsanctioned AI services via browser | Partial |
| HHS Proposed (2025) | AI inventory requirement | Maintains inventory of AI tools accessed via browser that may touch PHI | Partial |
SOC 2
Service Organization Control 2
SOC 2 is a compliance framework for service organizations based on Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
How ShadowWatch Helps: ShadowWatch addresses SOC 2 criteria by providing visibility into browser-based AI tool usage, maintaining audit trails, and detecting potential data disclosure to third-party AI services.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| CC6.1 | Logical access controls | Tracks browser-based AI tool access and associated data flows | Partial |
| CC7.1 | System operations monitoring | Real-time monitoring of AI data transmissions in browsers | Partial |
| CC9.2 | Vendor monitoring | Maintains inventory of AI vendors with risk assessments | Partial |
| CC6.7 | Data transmission | Monitors data sent to AI providers in browsers, identifies sensitive data exfiltration | Partial |
| CC6.8 | Unauthorized disclosure | Detects confidential data sharing with unsanctioned AI tools in browsers | Partial |
PCI DSS
Payment Card Industry Data Security Standard
PCI DSS is the security standard for organizations handling credit card data. It establishes requirements for protecting cardholder information throughout the data lifecycle.
How ShadowWatch Helps: ShadowWatch helps organizations maintain PCI DSS compliance by monitoring AI tool usage in browsers within cardholder data environments and maintaining service provider inventories.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| 7.2 | Least privilege access | Identifies AI tools with excessive data access, supporting access control reviews | Supporting |
| 8.2-8.6 | User authentication | Logs AI service account usage in browsers, detects unauthorized accounts | Supporting |
| 12.8.1 | Service provider inventory | Maintains inventory of AI service providers accessed via browser | Partial |
CIS Controls
Center for Internet Security Controls
CIS Controls are prioritized cybersecurity best practices. They provide actionable guidance for defending against common cyber attacks through technical controls.
How ShadowWatch Helps: ShadowWatch addresses CIS Controls for asset and software inventory (the foundation of security programs) by discovering and cataloging AI tools accessed via browser.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| 1.1 | Establish asset inventory | Discovers and catalogs AI tools accessed via browser across the organization | Partial |
| 2.1 | Establish software inventory | Maintains inventory of AI applications and browser extensions | Full |
| 2.3 | Unauthorized software | Detects and alerts on unsanctioned AI tools accessed via browser | Partial |
FISMA/NIST
Federal Information Security Modernization Act
FISMA requires federal agencies to implement the NIST Risk Management Framework. NIST SP 800-53 provides security and privacy controls for federal systems, now with AI-specific overlays.
How ShadowWatch Helps: ShadowWatch addresses FISMA continuous monitoring requirements and supports NIST SP 800-53 AI system overlays for automated monitoring and risk assessment of browser-accessed AI tools.
| Control | Requirement | ShadowWatch Coverage | Alignment |
|---|---|---|---|
| SI-04(02) | System monitoring - automated analysis | Real-time monitoring of browser-based AI tool usage with anomaly detection | Partial |
| CA-07 | Continuous monitoring | Ongoing monitoring of AI-related risks and controls for browser-accessed tools | Partial |
Get the audit trail before the regulator asks for it.
Only 24% of AI-using organizations have adequate AI security (IBM 2025). Be one of them.