Shadow AI is the use of artificial-intelligence tools inside an organisation without the approval, knowledge or monitoring of IT, security or legal. The term descends directly from “Shadow IT”, and the mechanics are the same: the technology arrives at work through the end user’s door, not through the governance door.
What differs is speed and asymmetry. Shadow IT took months to establish itself, because it required installing something. Shadow AI establishes itself in an afternoon, because it requires only a browser tab — and the employee doing it is almost always trying to deliver better work, not to evade a control.
Why Shadow AI is not just more Shadow IT
Treating the two with the same playbook is the most common mistake. Three characteristics make AI risk structurally different:
- The data entered may not come back. In classic Shadow IT, a file uploaded to the wrong Dropbox can be deleted. A contract excerpt pasted into a tool whose plan permits training on customer data may already be baked into a model’s weights. There is no delete button for that — and it is precisely the scenario that a right-to-erasure provision cannot address after the fact.
- The output enters decisions with no trace. A report, a price or a clause generated by AI and pasted into an official document loses its origin marker at the first copy-paste. When the result is challenged months later, nobody can reconstruct how it was produced.
- Agents act on their own. The current generation of tools does not answer questions: it opens files, browses, calls APIs and chains tasks. A single access granted without review stops being a one-off leak and becomes an autonomous process holding credentials.
The question that separates the two disciplines is simple: in Shadow IT, the risk is where the data ended up. In Shadow AI, the risk is what the data became — and what the tool does next, with nobody asking.
How Shadow AI gets in
In practice, nearly every case we see falls into one of four patterns — and only the first is the one most companies picture when they think about the problem:
| Pattern | How it shows up | Why it goes unnoticed |
|---|---|---|
| Personal account in a web tool | An employee uses their own free account in a chat assistant, translator or image generator, on the company machine. | Nothing is installed, procurement is not involved, no invoice is generated. |
| AI feature switched on inside an approved tool | An already-approved vendor ships an AI capability in an update — meeting transcription, email summaries, autocomplete. | The tool was approved before it had AI. Nobody reassessed it. |
| AI bought by a business unit | Marketing, legal or HR sign up for a tool on the corporate card, with no vendor assessment. | The spend is small enough not to trigger the procurement process. |
| Technical use of a model or API | A development team consumes a model API, or runs a local model, in an internal project. | It stays inside the technical team and never appears as 'software' in any inventory. |
The second pattern is the most underestimated. A meaningful share of AI usage in a company today did not begin with someone deciding to use AI: it began with an already-approved vendor turning on a new feature. The vendor inventory stays correct while the processing inventory quietly stops being so.
The risks, in order of likelihood
It is worth separating risk that is real and frequent from risk that is quoted in slide decks. In the order things actually happen:
1. Confidential data leaking through legitimate use
This is not an attack, it is routine: a contract pasted in to be “summarised”, a payroll spreadsheet uploaded to be “analysed”, proprietary code sent off to be “refactored”. The person is working. The data left the perimeter and, depending on the plan in use, may have entered training.
2. Losing your legal basis for processing
If a company processes personal data and sends that data to a third party without it appearing in the record of processing activities, without a mapped legal basis and without a processing agreement, the irregularity is not the leak — it is the processing itself. That becomes a finding even if nothing ever leaks. See the guide on LGPD and AI tools.
3. Invisible operational dependency
Processes come to depend on a tool the company does not know it uses, did not contract and has no SLA for. When the tool changes its pricing or its policy, or goes offline, the team discovers it was infrastructure.
4. Improper use of generated content
Generated text, images or code enter commercial material with no verification of rights or accuracy. The lowest-probability risk and the highest reputational cost.
One data point to calibrate urgency: McKinsey’s State of AIresearch finds that the large majority of organisations already use AI in some form, yet only around a third have managed to scale it — and roughly half report having already faced a negative consequence. The gap between “we use AI” and “we govern our use of AI” is where Shadow AI lives.
Why banning does not work
The instinctive reaction is to block the known domains at the firewall and publish an announcement. That fails for three reasons, in ascending order of seriousness:
- Usage migrates, it does not disappear. Blocked on the corporate desktop, the employee uses their personal phone. The work still gets done with AI; the company has only lost the ability to know which AI.
- The list goes stale in weeks. Blocking by domain presupposes knowing the domains. New tools appear constantly, and most real usage sits in the long tail — dozens of small tools, not the famous five.
- The company starts asserting something false.This is the worst of the three. A policy that says “AI use is prohibited” in a company where 60% of people use AI converts a security problem into a documentation-compliance problem: there is now a signed document that contradicts actual behaviour, and that document is what the auditor reads.
It is worth being explicit about something that confuses a lot of people: no governance framework — not the LGPD, not ISO/IEC 42001, not the EU AI Act — requires a company to block AI tools. All of them require it to know what is in use, to have made a conscious decision about each item, and to be able to demonstrate that. Approving with a written policy is compliance. Prohibiting on paper while not knowing what happens in practice is the opposite.
How to detect Shadow AI
Visibility comes before policy — you cannot write rules about an environment you cannot see. There are three ways to obtain that visibility, and they are not mutually exclusive:
| Method | What it sees | Limit |
|---|---|---|
| Endpoint agent | Running processes, DNS queries and browser history on the workstation — including off the corporate network. | Requires installation. Does not cover personal devices (BYOD). |
| NGFW, SSE or SIEM logs | All traffic crossing the corporate network or proxy, with nothing installed on the machines. | Blind to machines off the network and to traffic that bypasses the proxy. |
| Browser extension | Which account and which plan are in use in each tool — the difference between the free account, which usually trains on your data, and the corporate one, which does not. | Only covers the browser it is installed in. |
None of the three is useful without a catalog behind it: a list of domains and processes known to be AI tools, with a risk classification. Without that, the output is a traffic log, not an inventory. Our AI tool catalog is public and free to browse.
A privacy detail that will stall the project if it is not settled early: detecting which tool was used is not the same as reading what was typed into it. The first is inventory and is what governance needs; the second is content monitoring, carries its own legal regime and is usually disproportionate. Saying this explicitly in the internal announcement completely changes how employees receive the programme.
The path, in four steps
Order matters more than speed. Programmes that start with the policy rather than the inventory almost always end up rewriting the policy.
- 1. Inventory. Find out what is in use, on which machines and how often. No judgement at this stage — the goal is the map, not enforcement.
- 2. Classify. Each tool becomes allowed, restricted or prohibited, with the reasoning recorded. This is where the catalog and the risk level come in.
- 3. Publish the policy. Short, specific about what kind of data may go into which category of tool, and signed. See the annotated AI usage policy template.
- 4. Monitor and remediate. A prohibited tool detected becomes a task with an owner and a deadline, not a line in a report. That is the difference between a living programme and a document in a drawer.
Frequently asked questions
What is Shadow AI?
Shadow AI is the use of artificial-intelligence tools inside an organisation without the approval, knowledge or monitoring of IT, security or legal. It ranges from an employee pasting a contract into a personal ChatGPT account to a team putting a model API on the corporate card with no vendor assessment.
What is the difference between Shadow AI and Shadow IT?
Shadow IT is the use of any unapproved software. Shadow AI is a subset with three aggravating factors: the data entered may be absorbed into model training and cannot be retrieved; the tool produces content that feeds business decisions with no trace of origin; and agentic tools act on their own, widening the blast radius of a single unreviewed access.
Does banning AI solve the Shadow AI problem?
No. A ban without detection simply moves usage beyond the company's reach — to the personal phone, the personal account and the home network. The risk is unchanged and the visibility is gone, with the added problem that the company now formally asserts something that is not true. No governance framework requires blocking; all of them require the company to know what is in use.
How do you detect Shadow AI in a company?
Three routes: a lightweight endpoint agent that observes processes, DNS queries and browser history; ingestion of the NGFW, SSE or SIEM logs the company already has, with nothing installed; and a browser extension that identifies which account and plan are being used in each tool. All three resolve domains against a catalog of known AI tools.