Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How to run an AI amnesty?

No published, named case study reports an organization's AI amnesty results in verifiable detail, so the answer rests on practitioner guidance: a fixed window, a no-punishment commitment from leadership, a questionnaire on tool, task, data and account, and a decision on every disclosed tool. Without a sanctioned route for the work it surfaces, an amnesty produces only an inventory.

Previously unregistered application tasks pass a review gate into three organized task collections.

No published, named case study reports an organization's AI amnesty results in verifiable detail, so the answer rests on practitioner guidance: a fixed window, a no-punishment commitment from leadership, a questionnaire on tool, task, data and account, and a decision on every disclosed tool. Without a sanctioned route for the work it surfaces, an amnesty produces only an inventory. An AI amnesty is a time limited period in which employees can disclose the unapproved AI tools they use at work, and the data they put into them, without punishment. That gap in the public record matters, because the value of an amnesty depends entirely on design choices that are rarely documented. The sections below cover what an amnesty is, why organizations consider one, how the published guidance says to run it, what it can and cannot reveal, and what should happen after the window closes. The work it surfaces then needs a route where the AI receives only what each task requires, the principle of Least Exposure. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • An AI amnesty is defined in practitioner guidance as a voluntary disclosure program with a defined time frame, asking staff which tools they use, for what purposes, and with what kinds of business data (TechTarget, 2025).
  • The underlying problem is measured: 78 percent of AI users brought their own AI tools to work in the Microsoft and LinkedIn Work Trend Index survey (Microsoft, 2024).
  • IBM found that 20 percent of organizations in its 2025 breach study had a breach involving shadow AI, and that high levels of shadow AI added 670,000 dollars to average breach cost (IBM, 2025).
  • The UK National Cyber Security Centre advises against relying on bans alone and recommends providing approved alternatives, because policy that cannot meet business needs drives adoption underground (NCSC, 2026).
  • No primary source located documents a named organization publishing participation rates, tool counts, or outcomes from its own amnesty, so claims about typical results should be treated as unproven (TechTarget, 2025).
  • An amnesty produces a self reported inventory, which the NIST AI Risk Management Framework would place under its Map function, and that inventory still needs technical verification (NIST, 2023).

What is an AI amnesty, in plain terms?

An amnesty borrows a familiar idea from compliance and safety reporting: for a fixed period, the organization trades punishment for information. Employees name the AI services they use without approval, describe the tasks those services perform, and identify the categories of data involved. In return, the organization commits in advance that disclosure itself will not trigger discipline (TechTarget, 2025).

The distinction from a normal survey is the commitment. A survey asks questions, and staff may still fear that honest answers will be used against them. An amnesty removes that fear for the window, at least in stated policy, and sets a clear date after which the normal rules apply again. Practitioner guidance typically places the window at one to two months, long enough for people on leave or in busy teams to respond, and short enough to create urgency (TechTarget, 2025).

An amnesty is also different from discovery tooling. Technical discovery observes traffic, accounts, and devices, and it is covered in detail in companion reporting on detection methods. An amnesty asks people. Each approach sees things the other misses. People can explain why a tool was chosen and what work depends on it, which traffic logs cannot show. Traffic logs can show tools that people forget, minimize, or choose not to mention.

Why would an organization offer one instead of enforcing its policy?

The practical reason is that enforcement without an inventory punishes the visible and leaves the hidden untouched. Microsoft reported that 75 percent of knowledge workers used AI at work and that 78 percent of AI users brought their own tools (Microsoft, 2024). When use is that widespread, a policy that treats every instance as misconduct creates a strong incentive to conceal, and concealment is the condition that makes shadow AI risky in the first place.

The NCSC makes a related point in its 2026 guidance on shadow AI: where security policy cannot meet a business need, employees adopt services before the organization has assessed them or offered an approved alternative (NCSC, 2026). The NCSC also notes that data entered into consumer services may be stored, retained, or used to improve the service outside corporate governance arrangements, unless specific privacy controls are in place (NCSC, 2026). An amnesty does not remove that exposure for past use, but it tells the organization where exposure may already have occurred.

Cost data explains why boards pay attention. IBM reported that organizations with high levels of shadow AI faced 670,000 dollars in additional breach costs compared with organizations with low or no shadow AI, and that customer personal data was compromised in 65 percent of shadow AI breaches and intellectual property in 40 percent (IBM, 2025). IBM also reported that 97 percent of organizations that had an AI related breach lacked proper AI access controls (IBM, 2025). An amnesty is one low cost way to find out whether those controls are missing where it matters.

How does the published guidance say to run an amnesty?

Published practitioner guidance sets out a sequence, and the sequence matters more than any single step (TechTarget, 2025). First, senior leadership approves the program and communicates the no punishment commitment personally, because a promise from an anonymous mailbox carries less weight. Second, the organization fixes the time frame and publishes both the start and the end date. Third, it issues a questionnaire that is short enough to complete and specific enough to be useful.

Fourth, the organization needs a channel that protects the respondent. Some programs accept anonymous submissions, which raise participation but make follow up questions impossible. Others accept named submissions with a written assurance that the response stays within the governance team. Neither design is neutral. Anonymous channels tend to surface the existence of a tool, while named channels surface the workflow, the data, and the business owner who can help replace it.

Fifth, the organization commits to publishing what it will do with the results: which tools will be assessed, on what timetable, and what happens to a tool that fails assessment. Guidance on amnesty programs stresses sponsorship and a communications plan for exactly this reason, because participation collapses if the first round produces silence (TechTarget, 2025).

What kinds of disclosures should the questionnaire ask for?

A useful questionnaire asks about four things: the tool, the task, the data, and the account. The tool question should capture the service name, whether it is a web service, a browser extension, a mobile application, or a feature inside an already approved product, because each form carries a different control path. The task question should ask what work the tool performs and how often, since a weekly contract summary and a one time experiment do not present the same risk.

The data question is the most sensitive and the most important. Respondents should be asked to classify what they entered: public information, internal information, customer personal data, financial records, source code, credentials, or regulated records. That classification connects the amnesty to existing data handling rules, and it mirrors the data privacy risk that NIST lists for generative AI, which includes leakage and unauthorized disclosure of personal and sensitive data (NIST, 2024).

The account question asks whether the tool is used through a personal account, a shared team account, or a corporate account, and whether it was paid for personally, expensed, or free. Account type determines what the organization can actually control. It cannot apply retention settings, access controls, or deletion requests to a personal account it does not administer. IBM's finding that most organizations with AI related breaches lacked proper AI access controls underlines why account type is not an administrative detail (IBM, 2025).

Questionnaires should also ask what the employee would need from an approved alternative. That single question converts a risk register into a procurement brief, and it signals that the organization intends to solve the underlying problem rather than catalog it.

What can an amnesty not find, even when it is well run?

An amnesty finds what people know about and are willing to report. It does not find AI features that were switched on inside approved software without a visible announcement, integrations built by one team and inherited by another, or tools used by staff who never saw the communications. It also does not find use by contractors or suppliers working on the organization's data outside its own workforce survey.

Self reporting has a second limit: memory and framing. A person who pasted a paragraph into a chatbot once may not regard that as using an AI tool for work, and may answer no in good faith. A person who built an automation around a model API may describe it as a script rather than as AI. Questionnaire wording therefore shapes the result as much as honesty does.

For those reasons, the NIST AI Risk Management Framework is a useful corrective. Its Map function calls for an inventory of AI systems and their context, and its Measure and Manage functions call for ongoing assessment and response rather than a one time count (NIST, 2023). An amnesty can seed the Map step. It cannot substitute for Measure and Manage, and it should be paired with technical discovery and with a standing route for requesting new tools after the window closes.

There is also no published evidence base for response rates. Because no named case study with verifiable numbers was located, any claim that a typical amnesty surfaces a specific percentage of total use would be speculation, and none is made here.

What should happen to each disclosed tool after the window closes?

Each disclosure needs a disposition, and the disposition should be recorded against the tool rather than against the person. A practical set of outcomes has four categories. Approved: the tool is assessed, contracted under enterprise terms, and added to the approved list. Approved with conditions: use may continue for defined tasks and data classes only. Replaced: an approved alternative covers the task, and the disclosed tool is retired with a migration date. Prohibited: the tool presents a risk the organization will not accept, and use must stop, with the data handling question addressed explicitly.

The data handling question is often missed. If customer personal data was entered into a consumer service, stopping future use does not address the copy that may already be retained by that service. The NCSC warns that such information may be stored or retained outside established governance arrangements (NCSC, 2026). Organizations may need to check the service terms, request deletion where the terms allow it, and record the exposure for regulatory purposes, taking legal advice where regulated data is involved.

Finally, the organization should convert the amnesty from an event into a process: a published request route for new tools, a target decision time, periodic re inventory, and audit for unsanctioned use. IBM reported that only a minority of organizations with AI governance policies regularly audit for unsanctioned AI use (IBM, 2025). A standing process is what separates a disclosure exercise from governance.

Where does RedactSure sit?

An amnesty fails without a sanctioned route for the work it surfaces. The disclosures that matter most describe sensitive tasks staff were feeding to public tools: a contract summary with customer names in it, a claims note with a policyholder's details, a spreadsheet of account numbers. RedactSure is that route. Supervised AI co-workers complete the browser workflow in the organization's existing applications, with no per-application integration and no change to user permissions. Policy chosen values become tokens at the render layer before any model reads the screen, so the model works with ACCT_001 and PATIENT_001 rather than the real identifiers, and real values resolve only at approved destinations at the moment of an approved action.

The Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy and approves each consequential action as it runs, under Supervised Delegation. Screens as tokens, actions, and approvals enter the AI Control Record, which exports to the customer's own SIEM, so the audit for unsanctioned use that IBM found most organizations skip has a record to run against. Keys stay with the customer and the model is swappable. Deployed in pilot, that gives disclosure somewhere governed to land. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

The page rests on published primary and practitioner sources, read as of October 13, 2026: the Microsoft and LinkedIn Work Trend Index 2024 (industry survey), IBM's Cost of a Data Breach Report 2025 (industry analysis), the NCSC's 2026 guidance on the hidden risks of shadow AI (official guidance), the NIST AI Risk Management Framework 1.0 and its Generative AI Profile, NIST AI 600-1 (standards and official guidance), and practitioner guidance on amnesty program design published by TechTarget in 2025 (industry press). Survey and breach figures are reported as published by their original publishers and reflect their samples, methods, and dates, not a new measurement.

No interviews were conducted and no amnesty was run. No AI tool, discovery product, or governance platform was tested hands-on, and no vendor's feature set is described beyond what its documentation states. The central limitation is the absence of a published, named, verifiable case study of an organization reporting its own amnesty participation and outcomes, so program design is described from guidance rather than from measured results at a specific employer. The window lengths, questionnaire fields, and disposition categories are practitioner recommendations, not findings. Vendor features and government guidance change; this page carries its date and is revised when the sources change. The contract summary, claims note, and account spreadsheet examples describe task types, not any organization; no customer or prospect is described.

Nothing here is legal advice on employee discipline, privacy, or regulatory notification. Whether an amnesty is lawful in a given jurisdiction, what an employer may promise its staff, and whether past disclosure to a consumer service is a reportable event belong to the organization's counsel, assessor, privacy officer, and compliance officer, not to the page.

What the record shows

No named organization has yet published a verifiable account of its own AI amnesty, so the honest answer to how it worked is that the public record cannot show it. Guidance does establish the shape of a credible program: a defined window, disclosure made safe, questions capturing tool, purpose, and data type, and a decision following every disclosure. An amnesty run without a sanctioned route for the work it surfaces produces a list and a return to concealment once the window closes. The test for any program is one question: for each tool disclosed, where does that work go now, and who decided what the replacement is allowed to see?

Frequently asked questions

Does an amnesty replace technical discovery of shadow AI?

No. An amnesty produces a self reported inventory, and self reporting is partial by nature: people forget tools, judge some too minor to mention, or stay silent about the ones they expect to cause trouble. The inventory is a starting point that network records, identity data, and other discovery methods still need to check. Anything the amnesty surfaces that technical monitoring missed is useful evidence about where that monitoring is blind.

What should employees be promised while an amnesty runs?

The promise has to be specific enough to believe: disclosure inside the window will not be punished, the window has a stated closing date, and the organization will explain what happens to each disclosed tool afterwards. Vague reassurance fails because staff weigh the offer against their own experience of policy enforcement. The definition in practitioner guidance is a voluntary program with a defined time frame, so the dates, the questions, and the consequences should all be published before it opens.

What happens to a disclosed tool once the window closes?

Each disclosed tool needs a decision, not a filing. Tools may be approved for defined uses, restricted to certain data categories, replaced by an approved alternative, or retired entirely, and the reasoning should be visible to the people who disclosed them. Disclosures also carry a second obligation: if staff describe putting sensitive data into a service, that exposure has to be assessed on its own terms, whether or not the tool itself is allowed to stay.

How long should an AI amnesty window stay open?

Practitioner guidance places the window at one to two months. That is long enough for people on leave or in busy teams to respond and short enough to create urgency. Both the start and the end date should be published at the outset, because the commitment only works if staff know when the normal rules return. A window with no stated end reads as a survey, and a survey does not remove the fear that drives concealment.

Should amnesty submissions be anonymous or named?

Neither design is neutral. Anonymous channels raise participation and tend to surface the existence of a tool, but they make follow up questions impossible. Named channels, with a written assurance that responses stay within the governance team, surface the workflow, the data involved, and the business owner who can help replace the tool. Many programs offer both and accept that the two channels produce different kinds of information.

What should the questionnaire ask about the data employees entered?

Ask respondents to classify what they entered: public information, internal information, customer personal data, financial records, source code, credentials, or regulated records. That classification connects the disclosure to existing data handling rules and to the leakage and unauthorized disclosure risks NIST lists for generative AI. Pair it with the account question, because retention settings and deletion requests cannot be applied to a personal account the organization does not administer.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.