ChatGPT, Grammarly, Gemini, Copilot — free and paid AI tools get adopted from the bottom up, tool by tool, often with company data pasted straight in. That’s shadow AI: the single biggest AI blind spot for most organizations. GOVERNBOX.ai helps you find it, account for it, and bring it under management — without pretending you can ban it.
Why shadow AI is dangerous
The problem isn’t that staff use AI — it’s that no one can see it, no one owns it, and no one set the rules. That’s how a helpful shortcut becomes a data breach, a compliance finding, or a headline.
A staffer pastes a client contract, patient note, or donor list into a free AI tool to 'summarize it.' You have no record it ever happened.
Tools adopted bottom-up have nobody accountable for how they're used, what they're trained on, or when they go wrong.
Individual AI subscriptions get expensed one at a time across teams — duplicated, unmanaged, and invisible to whoever owns the budget.
The first question in any AI review is 'name every AI tool you use.' Shadow AI is exactly the answer most organizations can't give.
Shadow AI discovery
No single source finds everything. The browser shows what people open; your identity provider shows what they sign in to; your staff know what they actually use. GOVERNBOX.ai brings all of it into one review queue, where every tool gets a decision and nothing is created or blocked behind your back.
The GOVERNBOX extension for Chrome, Edge and Firefox counts which AI sites staff open, how often, and whether they paste or upload — never what they type. Deploy it with your device management; staff are pseudonymous by default.
On Pro: export the application list from Okta, Google Workspace, Microsoft Entra, Netskope, Zscaler or Cloudflare One and drop it in. Every app that matches the AI tool catalog joins the same review queue, tagged with where it was seen.
A no-account link lets any employee report a tool they use or want. On Pro, Zapier, Jira, ServiceNow or any system that can call a URL files requests into the same triage queue through the API.
On Agency / Enterprise: import what your agent platforms already know — the autonomous and semi-autonomous agents running on your systems — and keep a baseline so you see when one gains access it did not have before.
GOVERNBOX proposes a vendor for every supplier already named across your records, so the AI behind your tools has an owner, an approval status and — on Pro — a questionnaire trail.
Approve, approve with conditions, hold for review or prohibit each tool. Staff see your decision on the tool's own site within about a minute, with a button to ask for a review.
One click turns a discovered tool into a draft entry in your AI Use Case Log. From there it feeds the rest of the system: an acceptable-use standard and AI policy generated from a reviewed control library, every clause cited, a crosswalk to the regulations you selected, the risk register, training and attestations, and a board report that counts what you found and what you decided.
A practical path
You don’t need a security team or a monitoring appliance. You need visibility, clear rules, and a record — all of which GOVERNBOX.ai gives you out of the box.
Let the five discovery sources build the honest inventory — every AI tool actually in use, approved and shadow — then give each a named owner and record the data it touches.
Publish a plain-language acceptable-use standard: which tools are okay, and exactly what data may and may not be pasted into them. Staff stop guessing.
Roll out short training and collect an attestation from each employee — so 'I didn't know the rule' stops being an excuse, and you have proof they acknowledged it.
Give staff a clear way to report an AI mistake or a data slip, and keep an incident log so a one-off scare becomes a tracked, closed-out event.
The payoff
Protect client and company data, stop paying for redundant tools, and be ready to answer a customer security questionnaire about your AI use — without a scramble.
Safeguard donor and constituent information, preserve public trust, and show your board you know exactly how staff use AI — stewardship you can evidence.
Banning AI just drives it further underground. Give staff approved tools and clear rules, and you get the productivity without the blind spots.
Transparent pricing
Start with the free Scorecard, then choose the plan that fits. One flat price for your whole organization, never per seat.
Prices below are for the AI Governance module — the first of four GOVERNBOX modules. See modular pricing →
NONPROFIT20 at checkoutBilled in US dollars. CA$ figures are approximate, at exchange rates from 4 September 2026.
Agency / Enterprise includes one advisory session with the founder. Working sessions, half-day module training and a guided program launch can also be bought on their own, on any plan — see GOVERNBOX.ai Advisory Services →
| Feature | Starter | Pro Most Popular | Agency / Enterprise |
|---|---|---|---|
| Core Platform | |||
| AI Readiness Scorecard | ✓ | ✓ | ✓ |
| AI Use Case Log (inventory + named owner per system) | Unlimited | Unlimited | Unlimited |
| Grounded document generation — every clause cites a reviewed control | ✓ | ✓ | ✓ |
| EU AI Act risk tier classification + Art. 5 prohibited-use screen | — | ✓ | ✓ |
| Dashboard — My Workspace | ✓ | ✓ | ✓ |
| Notifications center (review countdowns, alerts) | ✓ | ✓ | ✓ |
| Append-only audit log | ✓ | ✓ | ✓ |
| Multi-tenant security + row-level isolation | ✓ | ✓ | ✓ |
| Document Generation | |||
| AI Use Policy | ✓ | ✓ | ✓ |
| AI Acceptable Use Standard | ✓ | ✓ | ✓ |
| AI Incident Response Plan | ✓ | ✓ | ✓ |
| Vendor AI Risk Assessment | ✓ | ✓ | ✓ |
| AI Strategic Plan (wizard) | — | ✓ | ✓ |
| CAIO Position Statement (wizard) | — | ✓ | ✓ |
| AI Committee Charter (wizard) | ✓ | ✓ | ✓ |
| Privacy Policy (consumer / data-subject rights) | NIST Privacy Framework | NIST Privacy Framework + GDPR | NIST Privacy Framework + GDPR + CCPA |
| OMB AI Compliance Plan (M-25-21 / M-25-22) | — | — | ✓ |
| Compliance Crosswalk export — five shelves: Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global | NIST AI RMF + ISO/IEC 42001 + United Kingdom AI law & guidance + Canada | + ISO/IEC 42005 + AI frameworks, standards & healthcare guidelines + EU AI Act + European Union AI law & guidance + Italy AI law & guidance + GDPR + Global privacy laws + Switzerland AI law & guidance + Norway AI law & guidance + NIST SP 800-53 Rev. 5 + NIST Cybersecurity Framework (CSF) 2.0 | + Colorado ADMT Act (SB 26-189) + Colorado Chatbot Safety (HB 26-1263) + Connecticut SB 5 (PA 26-15) + Texas TRAIGA + California ADMT Regulations + Hawaii AI Acts (247 / 248) + Alabama AI laws + Arizona AI laws + California AI laws (other statutes) + Colorado AI laws (other statutes) + Connecticut AI laws (other statutes) + Delaware AI laws + Florida AI laws + Georgia AI laws + Idaho AI laws + Illinois AI law & guidance + Indiana AI laws + Iowa AI laws + Kansas AI laws + Kentucky AI laws + Louisiana AI laws + Maine AI laws + Maryland AI laws + Minnesota AI laws + Montana AI laws + Nebraska AI laws + Nevada AI laws + New Hampshire AI laws + New Jersey AI laws + New York AI laws + North Dakota AI laws + Oklahoma AI laws + Oregon AI laws + Rhode Island AI laws + South Carolina AI laws + Tennessee AI laws + Texas AI laws (other statutes) + Utah AI laws + Vermont AI laws + Virginia AI laws + Washington AI laws + Wisconsin AI laws + Wyoming AI laws + United States — federal law & state landscape + CCPA + U.S. state privacy laws + SOC 2 (Trust Services Criteria) + New York DFS cybersecurity regulation (23 NYCRR 500) + NAIC AI model bulletin (insurance) + NAIC Insurance Data Security Model Law (#668) + HIPAA + Global — Americas, Middle East, Asia-Pacific, Central Asia & international |
| Word (.docx) export | ✓ | ✓ | ✓ |
| PDF export | ✓ | ✓ | ✓ |
| Organization logo on document exports | — | ✓ | ✓ |
| Compliance Frameworks | |||
| NIST AI RMF | ✓ | ✓ | ✓ |
| ISO/IEC 42001 | ✓ | ✓ | ✓ |
| U.S. State AI Laws — all states, added as they pass | — | — | ✓ |
| · Colorado ADMT Act (SB 26-189) — eff. January 1, 2027 | — | — | ✓ |
| · Colorado Chatbot Safety (HB 26-1263) — eff. January 1, 2027 | — | — | ✓ |
| · Connecticut SB 5 (PA 26-15) | — | — | ✓ |
| · Texas TRAIGA — eff. January 1, 2026 | — | — | ✓ |
| · California ADMT Regulations — eff. January 1, 2027 | — | — | ✓ |
| · Hawaii AI Acts (247 / 248) | — | — | ✓ |
| · Alabama AI laws | — | — | ✓ |
| · Arizona AI laws | — | — | ✓ |
| · California AI laws (other statutes) | — | — | ✓ |
| · Colorado AI laws (other statutes) | — | — | ✓ |
| · Connecticut AI laws (other statutes) | — | — | ✓ |
| · Delaware AI laws | — | — | ✓ |
| · Florida AI laws | — | — | ✓ |
| · Georgia AI laws | — | — | ✓ |
| · Idaho AI laws | — | — | ✓ |
| · Illinois AI law & guidance — eff. January 1, 2027 | — | — | ✓ |
| · Indiana AI laws | — | — | ✓ |
| · Iowa AI laws | — | — | ✓ |
| · Kansas AI laws | — | — | ✓ |
| · Kentucky AI laws | — | — | ✓ |
| · Louisiana AI laws | — | — | ✓ |
| · Maine AI laws | — | — | ✓ |
| · Maryland AI laws | — | — | ✓ |
| · Minnesota AI laws | — | — | ✓ |
| · Montana AI laws | — | — | ✓ |
| · Nebraska AI laws | — | — | ✓ |
| · Nevada AI laws | — | — | ✓ |
| · New Hampshire AI laws | — | — | ✓ |
| · New Jersey AI laws | — | — | ✓ |
| · New York AI laws | — | — | ✓ |
| · North Dakota AI laws | — | — | ✓ |
| · Oklahoma AI laws | — | — | ✓ |
| · Oregon AI laws | — | — | ✓ |
| · Rhode Island AI laws | — | — | ✓ |
| · South Carolina AI laws | — | — | ✓ |
| · Tennessee AI laws | — | — | ✓ |
| · Texas AI laws (other statutes) | — | — | ✓ |
| · Utah AI laws | — | — | ✓ |
| · Vermont AI laws | — | — | ✓ |
| · Virginia AI laws | — | — | ✓ |
| · Washington AI laws | — | — | ✓ |
| · Wisconsin AI laws | — | — | ✓ |
| · Wyoming AI laws | — | — | ✓ |
| · U.S. state law landscape — specific statutes from 27 states | — | — | ✓ |
| EU AI Act | — | ✓ | ✓ |
| ISO/IEC 42005 (AI impact assessment) | — | ✓ | ✓ |
| SOC 2 Trust Services Criteria (AI controls mapped into your SOC 2 program) | — | — | ✓ |
| NIST SP 800-53 Rev. 5 and NIST CSF 2.0 (cybersecurity, each with its own crosswalk) | — | ✓ | ✓ |
| CCPA / CPRA privacy statute (California) | — | — | ✓ |
| GDPR (EU data protection) | — | ✓ | ✓ |
| HIPAA Security & Privacy Rules | — | — | ✓ |
| OMB M-25-21 / M-25-22 (Federal AI) | — | — | ✓ |
| Regulatory Jurisdictions — enabled as one unit on the Organization Profile | |||
| United States — federal law & state landscape — 2 frameworks, enabled as one unit | — | — | ✓ |
| Canada — 1 framework, enabled as one unit | ✓ | ✓ | ✓ |
| AI frameworks, standards & healthcare guidelines — 2 frameworks, enabled as one unit | — | ✓ | ✓ |
| Europe — EU regulation, Italy, UK, Switzerland, Norway — 5 frameworks, enabled as one unit (United Kingdom AI law & guidance from Starter) | — | ✓ | ✓ |
| Global — Americas, Middle East, Asia-Pacific, Central Asia & international — 21 frameworks, enabled as one unit | — | — | ✓ |
| Risk & Impact | |||
| Risk Register (CRUD + likelihood × impact scoring) | ✓ | ✓ | ✓ |
| Risk heat map visualization | — | ✓ | ✓ |
| AI Impact Assessment (7-section questionnaire) | ✓ | ✓ | ✓ |
| Auto-create risk entries from assessments | — | ✓ | ✓ |
| AI Project Management Module | |||
| AI project list & per-project board | Up to 2 | Up to 5 | Unlimited |
| 7-phase AI development lifecycle checklist | ✓ | ✓ | ✓ |
| 45-item NIST/ISO/EU grounded task checklist | ✓ | ✓ | ✓ |
| Kanban board (drag-drop, task detail, Edit mode) | ✓ | ✓ | ✓ |
| Cross-links: Use Cases / Projects / Risk Register | ✓ | ✓ | ✓ |
| Agentic AI Governance Module | |||
| AI Agents inventory — basic registration (identity, ownership, data access) | ✓ | ✓ | ✓ |
| 12-item zero-trust controls checklist (NIST SP 800-207) | — | — | ✓ |
| Zero-trust score + low-score alerts | — | — | ✓ |
| Agent registration wizard (3-step) | ✓ | ✓ | ✓ |
| Agent metrics in Board Report governance block | ✓ | ✓ | ✓ |
| Cross-links: Agents / Use Cases / Risk Register | ✓ | ✓ | ✓ |
| Training, Incidents & Operations | |||
| Training plan + completion tracking | ✓ | ✓ | ✓ |
| Acceptable-use acknowledgment sign-off | ✓ | ✓ | ✓ |
| Incident log + severity codes | ✓ | ✓ | ✓ |
| EU AI Act Art. 73 serious-incident flag | — | ✓ | ✓ |
| Reporting & Governance | |||
| Quarterly Board Report (full — maturity score + quarterly history) | ✓ | ✓ | ✓ |
| AI Cost Tracking & Roll-Up (per use case + program office, 60-day renewal alerts, Board Report totals) | ✓ | ✓ | ✓ |
| Board Report — AI Agents governance section | ✓ | ✓ | ✓ |
| Governance maturity score + stars (dashboard/badge) | ✓ | ✓ | ✓ |
| Shareable governance badge | ✓ | ✓ | ✓ White-labeled |
| Live public Trust Page + embeddable live badge | ✓ | ✓ | ✓ White-labeled |
| Employee Attestation Portal (unlimited signers) | ✓ | ✓ | ✓ |
| Regulatory horizon feed ("What's Changing") | ✓ | ✓ | ✓ |
| Gap report with advisory CTAs | ✓ | ✓ | ✓ |
| Integrations & API | |||
| Vendor registry — approval lifecycle, terms on file, backfill from your records | ✓ | ✓ | ✓ |
| AI System registry — model, vendor, hosting, training-data notes | ✓ | ✓ | ✓ |
| REST API with scoped keys (every change audited as the key) | Read | Read + write | Read + write |
| Outbound webhooks — HMAC-signed, retried for up to a day | — | ✓ | ✓ |
| Intake connector — Zapier, Jira, ServiceNow, email or any webhook | — | ✓ | ✓ |
| Shadow AI Discovery — browser extension shows which AI tools staff use | ✓ | ✓ | ✓ |
| Shadow AI Discovery+ — Okta / Google Workspace / Entra / Netskope / Zscaler / Cloudflare One imports | — | ✓ | ✓ |
| Vendor questionnaires answered through a private vendor portal | — | ✓ | ✓ |
| Use-case approval gate — an Admin signs off before a use case goes active | ✓ | ✓ | ✓ |
| Interactive API reference (OpenAPI) | ✓ | ✓ | ✓ |
| Administration | |||
| Admin Console (full data inventory & controls) | Owner + Admin | Owner + Admin | Owner + Admin |
| User roles (Owner / Admin / Member) | ✓ | ✓ | ✓ |
| User invite & role management | ✓ | ✓ | ✓ |
| Enterprise SSO (SAML / OIDC) | — | — | ✓ |
| Data export (full org snapshot) | ✓ | ✓ | ✓ |
| Retention policy + danger zone (Owner only) | ✓ | ✓ | ✓ |
| Admin seats included (people who log in) | 10 | 15 | 20 |
| Staff participants — report AI tools, sign policies, complete training (no seat needed) | Unlimited | Unlimited | Unlimited |
| Staff AI-tool reporting portal (anonymous shadow-AI intake) | ✓ | ✓ | ✓ |
| Support & Advisory | |||
| Email support | ✓ | ✓ | ✓ |
| Onboarding walkthrough | — | ✓ | ✓ |
| Priority support | — | — | ✓ |
| Advisory session (1:1 with the founder) | — | — | ✓ Included |
Agency / Enterprise includes one advisory session. Working sessions, half-day module training and a guided program launch are also available on their own, at published fees — see GOVERNBOX.ai Advisory Services →
Common questions
Start free with the Readiness Scorecard, then build your AI inventory and set staff rules in minutes — no credit card required.