SHADOW AI ASSESSMENT · CANADIAN-OWNED · CISSP-LED
Shadow AI Assessment for Canadian Firms
Fusion Computing’s shadow AI assessment finds the AI tools your staff already use, from evidence your systems already record. You get findings your privacy lead can act on under PIPEDA, and a short list of controls to put in place.
A shadow AI assessment is a review of the AI tools staff use without the firm’s approval. That includes free chatbots on personal accounts, browser extensions that read web pages, apps given access to work mail and files, and AI subscriptions on expense claims. Fusion Computing runs it for Canadian firms with 10 to 150 employees where confidentiality is a professional duty.
According to the Microsoft and LinkedIn 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets, 75% of knowledge workers use AI at work and 78% of AI users bring their own AI tools to work. At small and medium-sized companies the figure is 80%. Personally chosen AI tools may bypass the firm’s approved sign-in and data controls.
What the review covers
Four places where AI use leaves a trace. Each answers a different question, and none is complete on its own. We choose the order at scoping, based on what your environment already records.
Work sign-ins and app permissions
Which work accounts have signed in to AI services, and which apps staff have allowed to read work mail and files.
Network traffic
Which devices on the office network reach AI services, including personal accounts your Microsoft 365 tenant cannot see.
Browsers
Which AI assistants are installed as browser extensions, and which of them can read the pages staff open.
Expense claims
Which AI vendors appear on expense claims or company cards. A recurring charge is a lead for steady use, confirmed before it is reported as one.
Google Workspace tenants follow the same logic through the admin console’s security reports and third-party app access controls. For the reasoning behind the four places, the guide on shadow AI in Canadian SMBs sets out the method in full.
Put company data into an unsanctioned AI tool and you’ve created another copy outside the controls your company relies on. Different retention, different access rules, maybe a different country, and if anyone asks later what was exposed, you can’t answer.
What you get
A findings document written for a privacy lead rather than an engineer. It names each piece of evidence, where it appeared, and which person, device or subscription it ties to. It also says what your tenant settings allow today. Where the evidence cannot prove something, the document says so.
If client or personal information may be involved, it records what is confirmed and what still needs interviews or vendor records. It sets out the facts a breach assessment needs, without making the notification call for you.
According to the Office of the Privacy Commissioner of Canada’s guidance on mandatory breach reporting, last updated in 2025, PIPEDA requires an organization to report breaches of security safeguards that pose a real risk of significant harm. It must also notify the people affected and keep a record of every breach for two years. Client information pasted into a personal AI account can raise exactly that question, and the facts decide the answer.
Alongside the findings comes a ranked list of controls. It covers who may approve new apps, which AI tools are approved, sign-in rules in Conditional Access, and the data worth labelling first. Fusion Computing quotes implementation after the findings and carries out the work you approve.
How the engagement runs
Scoping call
Sixty minutes to establish what your tenant and network can report, which varies more than most firms expect.
Read access
Time-limited, least-privilege access to the admin surfaces, recorded from start to finish. Nothing is installed on staff computers for the core review.
Review
The four places above, in the order agreed at scoping, with every finding tied to its evidence.
Findings session
A working session with whoever owns privacy in your firm, on what was found and which controls come first.
The work is CISSP-led. We do not quote putting controls in place before the findings exist, because the control list depends on what turns up.
Who this is for
Canadian firms with 10 to 150 employees where confidentiality is a professional duty: law firms, accounting practices, clinics, brokerages and wealth managers. It also fits owner-led businesses where staff started using AI before the business made a decision about it.
According to KPMG in Canada’s 2025 survey of 2,239 Canadian employees, 51% use generative AI tools at work, up from 22% in 2023, and employees are asking their workplaces for clearer AI policies. If staff use AI for client work, check which information those tools receive.
From your side, the review needs read access to the Microsoft 365 or Google Workspace admin surfaces, someone in finance who can search expense lines, and someone who knows which tools staff were told they could use. If the scoping call shows there is no real shadow AI question to answer, we will tell you and stop there.
What it costs
Scope decides it. The drivers are the number of staff, the admin surfaces available, and whether network traffic is already logged. A single-tenant firm with logging in place is a much smaller job than a two-tenant firm with none. We price the review after the scoping call, and you have the number before any work starts.
How this fits with our other AI work
This review answers what is already happening. An AI readiness assessment, a paid assessment, asks whether the firm is ready to adopt AI on purpose. This review usually comes first, because planning over unknown AI use is guesswork. Once the rules are set, AI enablement and training teaches staff to use the approved tools well.
If what you need is the document rather than the review, the guide on what belongs in an AI acceptable use policy covers it, and the LSO and CPA templates cover the regulated professions. Sector duties are set out in the guides for law firms and accounting firms.
Frequently asked questions about shadow AI assessments
Who runs shadow AI assessments for Canadian firms?
Fusion Computing, a Canadian-owned, CISSP-led IT firm founded in 2012, runs shadow AI assessments for Canadian firms with 10 to 150 employees, including law firms, accounting practices, clinics and wealth managers. The review reads Microsoft 365 sign-ins and app permissions, network traffic, browsers and expense claims, and produces findings a privacy lead can act on under PIPEDA. Nothing is installed on staff computers for the core review.
How long does a shadow AI assessment take?
Scope decides it. The admin work on a single Microsoft 365 tenant is short. Network analysis and a browser review add time, and a firm with two tenants or no existing logging takes longer. Fusion Computing sets the timeline at the scoping call, because the honest answer depends on what your environment can report.
Will this disrupt our staff?
Usually not. The core review reads admin, network, browser and finance records you already have, and nothing is installed on staff computers. If a source is not logged today, that comes up at scoping and the next step is agreed first. Tell staff the review is happening and why. Framing it as a hunt for misconduct pushes AI use further out of sight.
What if we find client data went into a consumer AI account?
Fusion Computing documents the technical facts a breach assessment needs. That means what information can be confirmed, whose it is, the account involved, how long it was exposed, the vendor terms that apply and the gaps in the evidence. Whether that meets the real risk of significant harm test under PIPEDA, or a provincial law, is for your privacy lead or counsel to decide.
Do we need this if we already have an AI policy?
Usually, yes. A policy sets out what staff may do, and the review shows what they actually do, including apps that already hold standing access to work mail and files. Use the findings to decide which parts of the policy need a technical control behind them. Repeat the review alongside your regular access reviews, because AI tools and staff both change.
A scoping call comes first
Sixty minutes establishes what your tenant can report, whether a review is worth running, and what it would cost. Fusion Computing is CISSP-led and Canadian-owned, has secured IT for Canadian firms since 2012, and serves Toronto, Hamilton and Metro Vancouver.
