Designing a Shadow AI Risk Classification Matrix Against NIST AI RMF and the EU AI Act

Designing a Shadow AI Risk Classification Matrix Against NIST AI RMF and the EU AI Act

Key takeaways

• The AB-731 skills list effective as of July 22, 2026 weights business value of generative AI at 35–40%, Microsoft AI apps and services at 35–40%, and implementation and adoption strategy at 20–25%.[1]
• Under adoption strategy, Microsoft measures responsible AI, governance principles, an AI council, Responsible AI standards (fairness, reliability, safety, privacy, security, inclusiveness, transparency, accountability), and “Understand potential impacts to data, security, privacy, and cost.”[1]
• Microsoft defines Shadow AI as AI that operates without governance: unsanctioned tools employees adopt on their own, and unmanaged agents that were never registered or brought under policy.[9] Purview’s deployment model adds the same core idea for generative tools used without IT knowledge, approval, or governance.[10]
• NIST AI RMF 1.0 (NIST AI 100-1, January 2023) is voluntary and organizes work into GOVERN, MAP, MEASURE, and MANAGE, with trustworthy AI characteristics including valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.[3]
• Regulation (EU) 2024/1689 (EU AI Act) uses a risk-based approach: Article 5 prohibits listed AI practices; Article 6 plus Annex III classify high-risk systems (with a documented Article 6(3) filter for some Annex III cases that do not pose a significant risk—except profiling, which stays high-risk).[5][6][7]
• The deliverable is a design risk classification matrix (CSV + local PowerShell checker) for internal vs external generative-AI applications. I did not run a real Shadow AI audit, block any production app, or take AB-731.

1. Study log: why Shadow AI needs a matrix, not a slogan

This is the third AB-731 entry. The governance council charter named decision rights. The illustrative Copilot TCO/ROI model named cost layers. Neither tells you how to triage an employee using a consumer chatbot on a work laptop versus an approved Microsoft 365 Copilot seat versus an unmanaged agent with connectors into SharePoint.

The queued title was “Mitigating Enterprise Shadow AI: Compliance Frameworks for NIST AI RMF and the EU AI Act.” I have not mitigated Shadow AI in any real tenant, so the truthful title keeps the SEO keywords and drops the mitigation claim. Everything below is design work from Microsoft Learn, NIST AI 100-1, and the official EU AI Act texts, plus a PowerShell script I ran against a synthetic CSV on this machine.

If you are still deciding whether the credential fits your role, the AB-731 certification guide covers audience, no-code boundary, and prep paths.

What an AI Transformation Leader is expected to do with risk

Microsoft describes the AB-731 candidate as a business decision-maker who recognizes AI transformation opportunities, identifies tools, plans adoption, and drives innovation with Microsoft 365 Copilot and Foundry Tools, without being expected to write code.[1][2] Championing responsible AI and aligning investments with business goals are part of that profile.[1][2]

For a systems engineer, Shadow AI is where adoption strategy meets secure AI: you need a repeatable way to inventory use, classify risk, and decide allow / govern / block without inventing legal conclusions your counsel has not signed.

Exam facts as of November 7, 2026

Blueprint note. The study guide shows one effective list: July 22, 2026.[1] Credential “Last Updated” is 07/22/2026.[2] There is no separate upcoming blueprint within 14 days of this publish date (November 7, 2026, America/Denver), so this entry uses the currently effective list and does not blend blueprints.

Default approach vs AI-hardened approach

How I built this entry

• Sources: Microsoft Learn, NIST AI 100-1 PDF, EUR-Lex Regulation (EU) 2024/1689 (OJ and consolidated text through 2026-07-27), and the Commission AI Act Service Desk Annex III page, all fetched on November 7, 2026 and listed at the end.
• Scenario: Contoso-Illustrative-ShadowAI inventory rows are synthetic. They are not a real tenant discovery export.
• Script: I ran the matrix completeness checker in section 4 on PowerShell 7.4.6 against a local CSV. It reads local files only.
• Not done: no Global Secure Access / Defender for Cloud Apps / Purview / Agent 365 deployment, no production block policy, no exam attempt, no legal opinion that any Contoso row is or is not high-risk under the EU AI Act.

2. Architecture: what the matrix has to keep separate

Definition: Shadow AI risk classification in this article

Shadow AI, as used here, follows Microsoft’s enterprise wording: AI that operates without governance, unsanctioned tools and unmanaged agents outside the controls applied to everything else.[9] Purview’s shadow-AI deployment intro describes generative AI tools used without IT knowledge, approval, or governance, with risks that include data leak, noncompliance, and reputational harm.[10] Global Secure Access Shadow AI discovery focuses on unsanctioned generative AI apps and tools visible in network traffic (chatbots, Model Provider APIs, SaaS MCP servers, and similar).[8]

Risk classification matrix, for this study entry, means a structured inventory that, for each generative-AI application or agent pattern, records: internal vs external hosting/path, approval state, data classes in scope, NIST AI RMF function hooks, and an EU AI Act screen (prohibited cue / Annex III area cue / not indicated from public facts / counsel required), with every Contoso example labeled SYNTHETIC.

It is not a claim that you completed a fundamental-rights impact assessment, conformity assessment, or market-surveillance filing.

Prereqs before you fill the matrix

1. A governance owner. AB-731 expects an AI council for strategy, oversight, and cross-functional alignment, plus Responsible AI standards.[1] Without named decision rights, the matrix becomes a spreadsheet nobody can act on.
2. A discovery input path. Microsoft documents Shadow AI discovery via Global Secure Access application usage analytics (generative AI filter), complementary Generative AI Insights for prompt/MCP depth, Agent 365 Shadow AI views for unmanaged agents, and Purview/Defender for Cloud Apps/Entra/Intune steps for discover → block unsanctioned → protect sanctioned → govern interactions.[8][9][10][11]
3. A primary-text baseline for frameworks. NIST AI RMF 1.0 for voluntary risk management structure;[3][4] Regulation (EU) 2024/1689 for binding EU market rules where they apply.[5][6]
4. Honest scope on EU applicability. The Act applies to listed operators (providers, deployers in the Union, and certain third-country cases where output is used in the Union, among others).[6] Your counsel decides if Contoso’s facts put a row in scope. The matrix only flags cues from public text.
5. A split between approved Microsoft paths and everything else. AB-731 still expects you to understand Copilot license types and adoption impacts;[1] approved Copilot is not “Shadow AI,” but it still needs data/security/privacy impact thinking.

NIST AI RMF hooks the matrix must carry

From NIST AI 100-1 (fetched November 7, 2026):[3]

Trustworthiness characteristics named in the framework: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair with harmful bias managed.[3] NIST also states the Framework is voluntary, rights-preserving, non-sector-specific, and use-case agnostic.[3]

EU AI Act screens the matrix must not blur

From the official texts (OJ version and consolidated text including Regulation (EU) 2026/1744 as shown on EUR-Lex 2026-07-27):[5][6]

3. Precise steps: build the classification matrix

Methodology

1. Re-fetch AB-731 skills list; confirm the effective “as of” date you will study against.[1]
2. Re-fetch NIST AI 100-1 (or the NIST publication page) and record citation NIST AI 100-1 / January 2023.[3][4]
3. Re-fetch Regulation (EU) 2024/1689 from EUR-Lex (OJ and current consolidated text) plus Annex III; note amendment markers such as Regulation (EU) 2026/1744 when present.[5][6][7]
4. Pull a discovery export or manual inventory. If you lack one, build a SYNTHETIC practice inventory only, and label it.
5. For each row, set hosting_path to internal (org-controlled tenant/environment) or external (consumer/SaaS outside your governed stack) or hybrid.
6. Set approval_state to approved, pending_review, unsanctioned, or unmanaged_agent.
7. Map NIST functions: at least one GOVERN action, one MAP context field, whether MEASURE evidence exists, and a MANAGE action.
8. Apply EU screens as cues only. When unsure, use counsel_required.
9. Run the local CSV checker. Fix schema errors before any executive read-out.

Step 1. Separate internal vs external generative-AI paths

Step 2. Fill the matrix columns (schema)

Required columns for the deliverable CSV:

Step 3. Work a synthetic Contoso inventory (not a real audit)

All rows below are SYNTHETIC. Replace them with discovery exports before any compliance claim.

Why SAI-003 is annex_iii_cue: Annex III area 4 covers AI systems intended for recruitment/selection and for decisions affecting work-related relationships, promotion/termination, task allocation based on behaviour/traits, or monitoring/evaluation of persons in such relationships.[7] An unmanaged “resume screener” is a cue for counsel, not a finished legal classification.

Why SAI-004 is prohibited_cue: Article 5 prohibits placing on the market, putting into service for that purpose, or using AI systems to infer emotions of a natural person in workplace and education institutions, except medical or safety reasons.[6]

Step 4. Tie Microsoft discovery actions to MANAGE without pretending you ran them

Purview’s published four-step model: discover AI apps; block access to unsanctioned AI apps; block sensitive data going to sanctioned AI apps; govern, audit, retain, and investigate AI interactions.[10] Global Secure Access documents discovery, risk scoring via the Defender for Cloud Apps catalog, usage patterns, and taking action (educate, monitor, or block).[8] Agent 365 guidance stresses visibility that ends in control, and treating Shadow AI as evidence of unmet need as well as policy risk.[9]

In this study entry those are documented control patterns, not steps I executed in a tenant.

Mid-series CTA

If Autopilot and Intune error codes still fill your week while Legal asks for a Shadow AI binder, grab the free Error Code Cheat Sheet and keep this matrix next to your governance charter draft and illustrative TCO sheet.

4. Engineering deliverable: local matrix CSV checker

The script below reads a local CSV, validates required columns and enums, prints a SYNTHETIC-friendly report, and can write matrix-report.json plus manifest.json. It does not call Graph, Azure, Global Secure Access, or any tenant API. -WhatIf skips the write path when ShouldProcess denies writes. -Rollback removes report artifacts it previously wrote.

Sample CSV (synthetic)

inventory_id,app_or_agent_name,hosting_path,approval_state,generative_ai,data_classes_in_scope,intended_purpose,nist_govern_hook,nist_map_hook,measure_evidence,manage_action,eu_screen,annex_iii_area,residual_risk_note,evidence_class,as_of_date
SAI-001,Contoso-Approved M365 Copilot,internal,approved,yes,internal,Approved productivity assist,Named AI council owner,Knowledge workers; org risk tolerance documented,partial,allow,not_indicated_from_public_facts,,Oversharing still possible via permissions,SYNTHETIC,2026-11-07
SAI-002,Contoso-Consumer Chatbot,external,unsanctioned,yes,confidential,Ad-hoc drafting outside IT,No owner in inventory,Employees; data leaving boundary,none,educate,not_indicated_from_public_facts,,Prompt content unknown without inspection,SYNTHETIC,2026-11-07
SAI-003,Contoso-HR Resume Screener Agent,internal,unmanaged_agent,yes,regulated,Filter applicants,Missing registration/owner,HR recruiters; candidates affected,none,escalate_counsel,annex_iii_cue,employment,May map to Annex III employment cues — counsel,SYNTHETIC,2026-11-07
SAI-004,Contoso-Classroom Emotion Meter,hybrid,unsanctioned,yes,regulated,Infer student emotion in class,No policy exception on file,Teachers/students; education context,none,escalate_counsel,prohibited_cue,,Art. 5 emotion inference cue — counsel,SYNTHETIC,2026-11-07
SAI-005,Contoso-Code Helper API key,external,unsanctioned,yes,internal,Code completion via personal key,Secrets in user profile,Developers; source may leave tenant,none,block_candidate,not_indicated_from_public_facts,,Key sprawl and IP leakage residual,SYNTHETIC,2026-11-07

Checker script (local files only)

#Requires -Version 7.0
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')]
param(
    [Parameter(Mandatory = $true)]
    [string]$CsvPath,

    [string]$OutDir = './matrix-out',

    [switch]$Rollback
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

function Get-FileHashSha256 {
    param([string]$Path)
    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash
}

function Write-Audit {
    param([string]$Action, [string]$Target, [string]$Detail)
    if (-not $script:AuditPath) { return }
    $line = '{0}`t{1}`t{2}`t{3}' -f (Get-Date -Format 'o'), $Action, $Target, $Detail
    Add-Content -LiteralPath $script:AuditPath -Value $line -Encoding utf8
}

$required = @(
    'inventory_id','app_or_agent_name','hosting_path','approval_state','generative_ai',
    'data_classes_in_scope','intended_purpose','nist_govern_hook','nist_map_hook',
    'measure_evidence','manage_action','eu_screen','annex_iii_area','residual_risk_note',
    'evidence_class','as_of_date'
)

$hostingOk = @('internal','external','hybrid')
$approvalOk = @('approved','pending_review','unsanctioned','unmanaged_agent')
$genOk = @('yes','no')
$measureOk = @('none','partial','documented')
$manageOk = @('allow','monitor','educate','block_candidate','escalate_counsel')
$euOk = @('prohibited_cue','annex_iii_cue','not_indicated_from_public_facts','counsel_required')
$annexOk = @('','biometrics','critical_infrastructure','education','employment','essential_services','law_enforcement','migration_border','justice_democracy')
$evidenceOk = @('SYNTHETIC','OFFICIAL_DISCOVERY_EXPORT')

if ($Rollback) {
    $script:AuditPath = Join-Path $OutDir 'audit.log'
    foreach ($name in @('matrix-report.json','manifest.json')) {
        $p = Join-Path $OutDir $name
        if (Test-Path -LiteralPath $p) {
            if ($PSCmdlet.ShouldProcess($p, 'Remove report artifact')) {
                Remove-Item -LiteralPath $p -Force
                Write-Audit -Action 'rollback' -Target $name -Detail 'removed'
            }
        }
    }
    Write-Output '{"rolledBack":true,"label":"SYNTHETIC checker"}'
    exit 0
}

if (-not (Test-Path -LiteralPath $CsvPath -PathType Leaf)) {
    throw "CSV not found: $CsvPath"
}

$rows = Import-Csv -LiteralPath $CsvPath
if (-not $rows -or $rows.Count -lt 1) {
    throw 'CSV has no data rows.'
}

$errors = [System.Collections.Generic.List[string]]::new()
$warnings = [System.Collections.Generic.List[string]]::new()
$cols = @($rows[0].PSObject.Properties.Name)
foreach ($c in $required) {
    if ($cols -notcontains $c) { $errors.Add("missing column: $c") }
}
if ($errors.Count -gt 0) {
    throw ($errors -join '; ')
}

$i = 1
foreach ($r in $rows) {
    $i++
    $id = [string]$r.inventory_id
    if ([string]::IsNullOrWhiteSpace($id)) { $errors.Add("row ${i}: inventory_id empty") }
    if ($hostingOk -notcontains $r.hosting_path) { $errors.Add("row ${i} ($id): bad hosting_path") }
    if ($approvalOk -notcontains $r.approval_state) { $errors.Add("row ${i} ($id): bad approval_state") }
    if ($genOk -notcontains $r.generative_ai) { $errors.Add("row ${i} ($id): bad generative_ai") }
    if ($measureOk -notcontains $r.measure_evidence) { $errors.Add("row ${i} ($id): bad measure_evidence") }
    if ($manageOk -notcontains $r.manage_action) { $errors.Add("row ${i} ($id): bad manage_action") }
    if ($euOk -notcontains $r.eu_screen) { $errors.Add("row ${i} ($id): bad eu_screen") }
    $annex = [string]$r.annex_iii_area
    if ($annexOk -notcontains $annex) { $errors.Add("row ${i} ($id): bad annex_iii_area") }
    if ($r.eu_screen -eq 'annex_iii_cue' -and [string]::IsNullOrWhiteSpace($annex)) {
        $errors.Add("row ${i} ($id): annex_iii_cue requires annex_iii_area")
    }
    if ($r.eu_screen -ne 'annex_iii_cue' -and -not [string]::IsNullOrWhiteSpace($annex)) {
        $warnings.Add("row ${i} ($id): annex_iii_area set without annex_iii_cue")
    }
    if ($evidenceOk -notcontains $r.evidence_class) { $errors.Add("row ${i} ($id): bad evidence_class") }
    if ($r.evidence_class -eq 'SYNTHETIC') {
        $warnings.Add("row ${i} ($id): SYNTHETIC — not a real discovery export")
    }
    if ([string]::IsNullOrWhiteSpace($r.nist_govern_hook) -or [string]::IsNullOrWhiteSpace($r.nist_map_hook)) {
        $errors.Add("row ${i} ($id): nist_govern_hook and nist_map_hook required")
    }
    if ($r.eu_screen -eq 'prohibited_cue' -and $r.manage_action -notin @('escalate_counsel','block_candidate')) {
        $warnings.Add("row ${i} ($id): prohibited_cue usually needs escalate_counsel or block_candidate")
    }
}

$report = [ordered]@{
    label           = 'SYNTHETIC / LOCAL matrix checker — not a compliance determination'
    sourceCsv       = (Resolve-Path -LiteralPath $CsvPath).Path
    sourceSha256    = Get-FileHashSha256 -Path $CsvPath
    checkedAt       = (Get-Date -Format 'o')
    rowCount        = $rows.Count
    errorCount      = $errors.Count
    warningCount    = $warnings.Count
    errors          = @($errors)
    warnings        = @($warnings)
    exitCode        = $(if ($errors.Count -gt 0) { 1 } else { 0 })
}

$json = $report | ConvertTo-Json -Depth 5
Write-Output $json

if ($errors.Count -gt 0) {
    exit 1
}

if ($PSCmdlet.ShouldProcess($OutDir, 'Create output directory and write matrix-report.json + manifest.json')) {
    New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
    $script:AuditPath = Join-Path $OutDir 'audit.log'
    Write-Audit -Action 'start' -Target $CsvPath -Detail 'SYNTHETIC matrix checker'
    $reportPath = Join-Path $OutDir 'matrix-report.json'
    Set-Content -LiteralPath $reportPath -Value $json -Encoding utf8
    $manifest = [ordered]@{
        outputDirectory = (Resolve-Path -LiteralPath $OutDir).Path
        createdAt       = (Get-Date -Format 'o')
        sourceCsv       = (Resolve-Path -LiteralPath $CsvPath).Path
        sourceSha256    = Get-FileHashSha256 -Path $CsvPath
        files           = @(
            @{ name = 'matrix-report.json'; sha256 = (Get-FileHashSha256 -Path $reportPath) }
        )
        label = 'SYNTHETIC'
    }
    $manPath = Join-Path $OutDir 'manifest.json'
    ($manifest | ConvertTo-Json -Depth 5) | Set-Content -LiteralPath $manPath -Encoding utf8
    Write-Audit -Action 'write' -Target 'matrix-report.json,manifest.json' -Detail ("rows={0}" -f $rows.Count)
}

exit 0

What I ran (local, synthetic)

Not tested: any live Microsoft 365 tenant, Global Secure Access export, Purview DLP policy, or counsel review. The script only reads the CSV you pass it.

5. Public-objective concepts to retain

Map this Shadow AI matrix work to the July 22, 2026 AB-731 list. Wording below follows Microsoft’s study guide.[1]

Gaps this entry leaves for later AB-731 study:

• Prompt engineering and RAG grounding depth under business value.[1]
• Researcher/Analyst, build/buy/extend, Graph depth under Microsoft AI apps and services.[1]
• Foundry Tools subscription models in dollar detail.[1]
• Executive readiness narrative, queued as AB731-04.
• Measured discovery exports, replace SYNTHETIC rows when you have them.

Which preparation path fits you

That table is a study plan, not a Microsoft recommendation. For whether the credential is worth your calendar, use the AB-731 worth-it guide.

6. Next step in the study journey

Next in the AB-731 track is preparing for the executive room: a study-journey readiness outline (not a claim that you already hold the certification). Before that episode, replace every SYNTHETIC matrix row with either an official discovery export or a blank, and send every prohibited_cue / annex_iii_cue row to counsel before anyone calls the program “compliant.”

If you also run Intune and Autopilot day to day, the free Error Code Cheat Sheet covers the endpoint failures that still show up while leadership debates Shadow AI policy.

Frequently asked questions

Does AB-731 require me to implement NIST AI RMF or the EU AI Act?

No. The public skills list focuses on responsible AI, governance principles, an AI council, Responsible AI standards, secure AI, and adoption impacts to data, security, privacy, and cost.[1] NIST AI RMF and the EU AI Act are primary frameworks this study entry uses to make those objectives concrete. They are not listed as a named AB-731 lab.

What is Shadow AI according to Microsoft?

Microsoft’s Agent 365 guidance: AI that operates without governance, unsanctioned tools employees adopt, and unmanaged agents never registered or brought under policy.[9] Purview’s deployment model describes generative AI tools used without IT knowledge, approval, or governance.[10] Global Secure Access Shadow AI discovery targets unsanctioned generative AI applications and tools visible in network traffic.[8]

Is NIST AI RMF mandatory?

NIST publishes AI RMF 1.0 as a voluntary framework intended to be rights-preserving, non-sector-specific, and use-case agnostic.[3] Organizations still follow applicable laws and sector rules; the RMF does not replace them.[3]

What makes an AI system high-risk under the EU AI Act?

Article 6: a safety-component/product path tied to listed Union harmonisation legislation with third-party conformity assessment, and/or AI systems referred to in Annex III (with an Article 6(3) filter for some non-significant-risk Annex III cases, except profiling).[6][7] This article only teaches the public structure; counsel applies it to facts.

Can I mark a consumer chatbot “prohibited” just because it is unsanctioned?

Not from the public texts alone. Article 5 prohibits specific practices (for example workplace/education emotion inference, social scoring with listed effects, untargeted facial-image scraping for recognition databases).[6] Unsanctioned productivity chat is usually a governance and data-leakage problem under org policy and Microsoft Shadow AI guidance,[8][9][10] unless the intended purpose matches a prohibited practice.

Which skills list should I study for AB-731 today?

As of November 7, 2026, study the list labeled “Skills measured as of July 22, 2026” on the live study guide.[1] Re-fetch the guide before you sit the exam in case Microsoft publishes a newer effective date.

Sources

All pages fetched November 7, 2026 (America/Denver).

1. https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-731 (Study guide for Exam AB-731: AI Transformation Leader)
2. https://learn.microsoft.com/en-us/credentials/certifications/ai-transformation-leader/ (Microsoft Certified: AI Transformation Leader)
3. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf (Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1)
4. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 (NIST publication page for AI RMF 1.0)
5. https://eur-lex.europa.eu/eli/reg/2024/1689/oj (Regulation (EU) 2024/1689, OJ L 2024/1689, 12.7.2024)
6. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (Consolidated text of Regulation (EU) 2024/1689 as shown 2026-07-27, including amendments)
7. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3 (ANNEX III. High-risk AI systems referred to in Article 6(2))
8. https://learn.microsoft.com/en-us/entra/global-secure-access/concept-shadow-ai-discovery (Shadow AI discovery in Global Secure Access)
9. https://learn.microsoft.com/en-us/microsoft-agent-365/guidance/govern-shadow-ai (Why Shadow AI governance matters for the enterprise)
10. https://learn.microsoft.com/en-us/purview/deploymentmodels/depmod-data-leak-shadow-ai-intro (Prevent data leak to shadow AI)
11. https://learn.microsoft.com/en-us/microsoft-agent-365/admin/agent-shadow-ai (Understand Shadow AI in Microsoft 365 admin center)