Skip to content
AI Security

Interview question · AI Governance, Risk & Compliance

How do you govern shadow AI?

Banning AI tools moves usage to personal accounts. The answer that works gives people a sanctioned path that is easier than the shadow one.

easyNewPreparation tags: JPMorgan Chase, Microsoft, SnowflakeUpdated Nov 2026

Banning AI tools moves usage to personal accounts. The answer that works gives people a sanctioned path that is easier than the shadow one.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Employees across the company use unapproved AI tools for work, including pasting customer data into consumer chatbots, and a manager proposes blocking all AI sites.

  1. Why is a blanket ban a poor first move?
  2. What should the company provide instead?
  3. What should the policy say?
  4. How would you discover shadow AI use?
  5. What if customer data has already been pasted into a consumer chatbot?
  6. What shadow AI programme would you run?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackTurn AI risk management into engineering practice: owners, gates and release criteria.Next in this trackWhat does the NIST Generative AI Profile (NIST AI 600-1) add to the core AI Risk Management Framework?Next in this trackWhat should a model card or system card contain if it is going to be useful for governance and security?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.