Shadow AI guide
What is shadow AI? A practical guide for organisations
Shadow AI is the use of artificial-intelligence tools for work without the organisation knowing about, approving, or governing that use. It can include an employee pasting text into a public chatbot, connecting an AI assistant to company data, or adopting an AI feature hidden inside existing software.
Why shadow AI happens
Most shadow AI is not malicious. Employees choose tools that help them write, analyse, translate, code, or serve customers faster. It becomes a governance problem when the organisation cannot see which tool is used, what data reaches it, or who is accountable for the result.
- AI features are added to familiar software without a separate procurement decision.
- Employees use personal accounts when an approved option is unavailable or unclear.
- Teams test tools before security, privacy, legal, and procurement teams can assess them.
- Policies describe prohibited behaviour but do not offer a useful approved alternative.
The risks to assess
Risk depends on the use case, the information involved, and the decisions influenced by the output—not only on the name of the tool. A public chatbot used to improve generic wording is different from the same chatbot used with personal data, confidential contracts, health information, or hiring decisions.
- Data protection: personal data may be processed without a clear purpose, legal basis, or processor agreement.
- Confidentiality: business information may leave approved systems or be retained by a provider.
- Quality: convincing but incorrect output can enter reports, code, or decisions.
- Compliance: the organisation may be unable to document its AI systems, roles, and controls.
- Access: integrations can give a tool broader access to mail, files, or customer systems than intended.
A sensible first response
Start with discovery and dialogue rather than a blanket ban. Build an inventory, identify the use cases that carry real risk, and give employees a clear route for requesting tools. Then apply proportionate controls and review them as tools change.
- Discover tools and use cases without reading employee messages, files, or prompts.
- Record owner, purpose, provider, data categories, integrations, and affected people.
- Prioritise uses involving personal, confidential, regulated, or decision-making data.
- Approve, restrict, replace, or stop each use with a documented reason.
- Train employees and keep the inventory current.
Frequently asked questions
Is shadow AI always prohibited?
No. The term describes AI use outside established visibility or governance. The correct response depends on the purpose, data, provider, access, and legal context. Some uses can be approved with simple controls; others should be restricted or stopped.
Is shadow AI the same as shadow IT?
Shadow AI is a form of shadow IT, but AI adds distinct concerns: prompts can disclose data, generated answers can be unreliable, models and providers change quickly, and an AI system's legal classification can depend on its intended use.
Can an organisation discover shadow AI without employee surveillance?
Yes. Discovery can focus on the existence of services and organisational account connections rather than message, file, or prompt content. Controls should be transparent, proportionate, and reviewed with privacy and employment-law responsibilities in mind.
Free orientation tool
Understand how the EU AI Act may apply
Answer plain-language questions, get explanations as you go, and see the official legal basis behind your result.
Start the AI Act assessment