Shadow AI
AI tools and personal accounts that staff use for work without the business having approved or reviewed them. It is usually a bigger exposure than the tools an organisation bought on purpose, because a written policy rarely covers it and nobody can see it.
What it means in practice
The governance article reports that 81% of employees and 88% of security leaders say they use unapproved AI tools at work, and that organisations with a high level of shadow AI averaged 670,000 US dollars more per data breach than those with little or none. The blog on banning AI tools describes the same pattern from the staff side: where there is no clear rule, a large minority of staff enter client, HR and financial information into personal accounts.
How we use it
The governance article recommends putting one plain question to every team: what AI tools do you use, for what, and on what kind of data. The answers feed an AI tool inventory and the rules in AI governance, and why banning AI tools does not work explains why a prohibition is not the place to start.
FAQ
Questions about Shadow AI
What is shadow AI?
Shadow AI is AI used for work without the business approving or reviewing it, such as personal accounts and tools switched on inside software the business already pays for. It is hard to see because it leaves no record anywhere the business runs.
Does banning AI tools get rid of shadow AI?
No. A ban removes the approved route but leaves the task, so the use moves onto accounts and devices the business cannot see. The blog on banning AI tools recommends an approved tool that is good enough, plus a one-page rule drawn by the kind of data.
What it means for a business
A ban does not remove shadow AI, it moves it onto accounts and devices the business cannot see. The way to shrink it is an approved tool that is good enough for daily work and a clear rule drawn by the kind of data, not by the name of the tool.
Ready to put this to work?
Tell us where your team is with AI and we will tell you honestly what would make the biggest difference.