Published on
Many organizations have struggled with employees using personal devices or unapproved software, but AI has made the issue more complicated. Shadow AI, or the use of unauthorized AI tools, significantly increases the chances of data leaks and regulatory violations.
AI can help make employees more productive and efficient, but only if the tools are safe and vetted. Understanding how to detect and prevent shadow AI is key to maintaining security and compliance.
What Is Shadow AI?
Shadow AI refers to employees using AI models, tools, features, and APIs without approval or oversight from the organization's IT team.
Over the past several years, the problem has become widespread. According to a recent study, 38% of employees share sensitive work information with AI tools without their employer's permission.1
Some of the most common examples of shadow AI include public generative AI chatbots, unreviewed AI features embedded in authorized SaaS programs, and developer extensions. Employees use these tools for a variety of tasks, such as writing code, editing text, and analyzing data.
How Is Shadow AI Different From Shadow IT?
Shadow AI is similar to shadow IT, but it focuses exclusively on a specific set of technologies. Shadow IT is a general term, encompassing any unauthorized or unmonitored software, hardware, cloud services, or digital tools employees might use.
One of the most important differences between shadow AI vs. shadow IT is the level of risk. While shadow IT creates security vulnerabilities, they're usually limited to data storage and access.
Shadow AI adds new risk on top of those. Data entered into a public tool may be retained or used to train future models, AI output can be wrong and still shape real decisions, and AI agents can take actions with whatever access they’re given.Why Do Employees Use Shadow AI Tools?
Employees generally don't use shadow AI because they want to break the rules. If they want to work more quickly and effectively and don't have access to sanctioned tools, they turn to unauthorized options.
Accessibility
Slow AI approval processes contribute to unsanctioned AI use. Frustration grows when teams have to wait for several weeks or months for company approval of a tool they find valuable.
Unauthorized AI tools are readily available to solve immediate problems, so they seem more appealing in the moment.
Awareness and Familiarity
A lack of training, education, and clear policies increases the chance of employees using shadow AI. They may assume a popular tool is safe and secure without realizing it lacks the security certifications or enterprise data protections your organization requires.
Some employees are also more comfortable using publicly available tools. According to Microsoft UK, 41% of employees say they choose tools at work because they use them in their personal lives.2
Embedded Tools
When working with certain approved platforms and software, your team may accidentally use shadow AI. Embedded AI tools are present in a variety of software, and vendors often switch on new AI features before IT has reviewed them. When writing an email or updating a document, employees click a new feature and believe it's safe.
What Are the Risks of Shadow AI?
Shadow AI risks range from data leaks to regulatory and compliance violations. Gartner predicts that by 2030, more than 40% of enterprises will have security or compliance incidents linked to unauthorized shadow AI. (3)
Employees can expose sensitive code, intellectual property, or customer files. Public AI tools store, reuse, and train on these kinds of data, and it remains on their servers indefinitely.
These kinds of tools can breach privacy regulations and guidelines, such as the GDPR, HIPAA, and EU AI Act. Companies with violations often face fines and legal penalties.
Shadow AI also prevents IT and security teams from monitoring activity. Without oversight, employees may use flawed AI output. For example, a team who doesn't know an AI tool has hallucinated information could use it for essential processes and decision-making.
How Can Organizations Prevent and Govern Shadow AI?
Organizations can limit how much employees use shadow AI by being transparent about the damage it can do. Your best defense is an informed team with access to high-quality AI tools.
Sanctioned AI Tools
Give your team a list of approved AI tools and software. Make sure they improve employee workflows so they aren't tempted to turn to unauthorized alternatives.
Have open conversations about what tools are working and why, and accept suggestions for additional options. Use an approval process so IT can fully vet them, and keep it fast enough that employees don’t give up and go around it.
AI Governance
Establish a clear set of AI usage policies, and identify which tools are allowed and restricted. Include information about what types of data employees can use with each tool. Because some types of AI tools have higher risk than others, tailor your policies by department or role.
Keep eyes on your employees' AI use by using detection methods to flag any unauthorized apps connected to your network. Be honest about your process, and explain how you'll continuously monitor AI use.
AI Training for Employees
Create a training program to teach employees about the potential harm of using shadow AI. A policy only works if people understand what it means for their day-to-day work, so go beyond the rules and teach the judgement behind them. Describe what sets sanctioned tools apart so they understand why you've selected them.
Show what can happen when the wrong data goes into an unauthorized tool. These practical examples make the consequences more real. Then measure what employees actually understand, not just who completed the course, so you can see where policy-related gaps remain.
Does Banning AI Tools Actually Stop Shadow AI?
Blanket bans on AI tools generally don't prevent employees from using them. Instead, they hide their usage. According to Gartner, 69% of organizations suspect or have confirmed that employees are using prohibited public AI.3
To make matters worse, employees who secretly use AI are less likely to report a security incident because they're afraid of disciplinary action.
Banning and blocking AI tools on company devices is also ineffective. Employees can still use the tools on their personal devices and put data at risk.
AI governance and comprehensive training from a provider like Security Journey are a better approach than outright bans. They encourage innovation and experimentation with AI while also setting safe boundaries to protect your organization.
1 Over a Third of Employees Secretly Sharing Work Info With AI, 2024
2 Rise in 'Shadow AI' tools raising security concerns for UK organisations, 2025
3 Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address, 2025
