Shadow AI

Shadow AI grows from the same forces as shadow IT: tools are easy to sign up for, often free and genuinely useful, while official approval can be slow. It also appears inside approved software, when vendors add AI features that may be on by default or enabled with a single click, and through browser extensions and personal devices.

Why it matters: the organisation loses control over where data goes, whether a vendor stores it or trains on it, and whether AI-assisted work meets quality and legal standards. That can lead to confidentiality breaches, regulatory exposure and decisions nobody can audit. For IT and procurement teams, discovering which AI tools are already in use is often the first step in deciding which ones to approve.

Example: a sales manager uploads a customer list to a free AI tool to draft outreach emails, without realising the free plan's terms allow the provider to retain the data.

Limits of the response: blanket bans can push usage further out of sight. Organisations usually manage shadow AI with discovery tools, a clear acceptable use policy, fast review of requested tools and approved alternatives that meet people's needs.