A data scientist needs a local LLM for a prototype. They pull the Ollama image, configure a Helm chart and deploy it to the development Kubernetes cluster. Three weeks later, the prototype is promoted to staging. Six months after that, it is running in production — processing customer data against a model that has never been documented, reviewed or approved.
This is not a hypothetical. Variants of this scenario are running in production Kubernetes clusters across regulated industries right now. The containers are there. The governance trail is not.
The detection challenge
What ZAP detects is broader than most teams expect. Known AI container images — Ollama, LocalAI, LM Studio, Hugging Face Text Generation Inference, vLLM, NVIDIA Triton Inference Server — are identified by image signature. Behavioural detection extends this to unknown containers: GPU-accelerated workloads without Platform Lead approval, high-memory containers with inference endpoint patterns, model serving configurations that do not match the approved image list.
The regulatory exposure by industry
For NHS organisations, an AI model processing patient data without DPIA documentation creates a simultaneous GDPR breach, a DSPT assertion failure (Standard 9) and, from August 2026, an EU AI Act registration failure if the AI constitutes a high-risk system under the Act.
For all regulated enterprises, EU AI Act enforcement from August 2026 creates a direct obligation to maintain an inventory of AI systems. You cannot maintain an inventory of AI systems you do not know about.
The governed response workflow
The ZAP response to shadow AI detection follows a governed workflow. Detection triggers a HIGH severity ITSM incident immediately — image identity, namespace, cluster, first detection timestamp and owning team from governance tags. The Platform Lead and Security Lead receive notification with three ZAP AI-generated containment options: remove, quarantine or whitelist.
Remove
Workload not approved. ZAP AI generates IaC change. PR raised. Platform Lead approves. Container removed.
Quarantine
Needs investigation. Network policy applied to isolate from production data. Review period defined.
Whitelist
Reviewed and approved. DPIA reference linked. EU AI Act documentation trail created automatically.
The first priority before August 2026
The most important action for regulated enterprises before EU AI Act enforcement in August 2026 is not documentation — it is detection. You cannot document what you cannot find.
Start with a full scan of every Kubernetes cluster in your estate.
See ZAP live
Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.