Quick answer: Shadow AI is the use of AI tools, models, agents or assistants inside an organization without the knowledge or approval of security, data and privacy teams. The risk is not the tool; it is the sensitive data employees paste, upload or connect to it. Governing shadow AI means discovering usage, classifying the data at stake, sanctioning a safe path, and monitoring continuously.
Three years ago, shadow AI meant a marketing analyst pasting a customer list into a free chatbot. In 2026 it means a finance team wiring an agent to a shared mailbox, a developer installing an unvetted coding assistant with repository access, and a department buying a SaaS product that quietly added "AI features" trained on whatever it can see. The surface has moved from prompts to connections.
This matters now because the regulatory and contractual exposure has caught up. The EU AI Act's obligations are phasing in, the Australian Privacy Act reforms have sharpened individual rights and penalties, and most enterprise customer contracts now contain explicit clauses on AI processing of their data. "We didn't know a team was using it" is not a defense any CISO or Chief Privacy Officer wants to run.
This article is for the people who own that problem: security leaders, data and privacy officers, and the AI governance leads who sit between them. It is a practitioner's playbook, not a product pitch.
What is shadow AI, and how is it different from shadow IT?
Shadow IT is unsanctioned software or infrastructure. Shadow AI is a subset with three properties that make it more dangerous per instance:
- It ingests data by design. A rogue project-management app stores what you type into it. An AI assistant invites you to paste the contract, the incident report, the source code, because that is how it delivers value.
- It can act, not just store. Agents and "AI features" bolted onto existing SaaS can send email, update records and call APIs on a user's behalf.
- It blurs the boundary of the organization. Consumer tiers of AI tools may use inputs for model training. Even enterprise tiers move data to a third party under terms most employees never read.
- Typical example — Shadow IT: Unapproved file-sharing app · Shadow AI: Consumer chatbot, browser AI extension, unvetted coding assistant, SaaS "AI feature", self-built agent
- Primary risk — Shadow IT: Data at rest outside control · Shadow AI: Sensitive data in prompts, retrieval and training; autonomous actions
- Discovery signal — Shadow IT: SaaS spend, DNS, CASB · Shadow AI: Same, plus browser extensions, API keys, model endpoints, OAuth grants
- Who owns it — Shadow IT: IT / security · Shadow AI: Security, data governance, privacy and legal together
The last row is the important one. Shadow AI cannot be solved by the security team alone, because the decision about what data may be used for what purpose belongs to the data and privacy owners.
What are the real risks of shadow AI?
Keep the risk register short and specific. Four categories cover nearly every incident we see discussed in practitioner rooms:
- Sensitive data leakage into LLMs. Customer PII, regulated financial data, source code and unreleased results entered as prompts or uploaded as files. Once a prompt leaves the tenant you cannot recall it. The OWASP Top 10 for LLM Applications lists sensitive information disclosure as a top-tier risk for exactly this reason.
- Loss of contractual and regulatory control. GDPR and the Australian Privacy Act both require you to know your processors. An unsanctioned AI vendor is an unknown processor. Sector rules such as APRA CPS 234 and the UK FCA's operational resilience expectations treat unmanaged third parties as a material weakness.
- Unreliable outputs entering business processes. Hallucinated figures in a board pack, fabricated case law in a filing, a mis-generated code dependency. Governance is not only about leakage; it is about where unverified output lands.
- Autonomous action without accountability. Agents with OAuth grants to mail, calendars, CRMs and ticketing systems act under a human's identity. When something goes wrong, the audit trail says the human did it.
Direction, not fabricated precision: surveys from vendors and analysts since 2024 have consistently found that a large share of employees use AI tools at work and that a meaningful minority admit to entering sensitive data. Treat that as the baseline assumption for your organization, not the exception.
How do you detect shadow AI in an organization?
Discovery is a layered exercise. No single control sees everything.
Network and proxy layer. Secure web gateways and CASB tools now categorize generative AI destinations. Pull 90 days of logs and rank domains by unique users and upload volume. This catches consumer chatbots and most browser-based tools.
Identity layer. Review OAuth consent grants in your identity provider and in Microsoft 365 / Google Workspace. Third-party AI apps that request mail, drive or calendar scopes show up here, and this is where the agentic cases hide.
Endpoint and browser layer. Inventory browser extensions and desktop apps. Many "AI writing assistants" read every page or document the user opens.
Developer layer. Scan repositories and CI pipelines for API keys to model providers, unapproved SDKs, and coding-assistant configurations. Check cloud accounts for model endpoints and vector databases spun up outside the platform team.
Finance and procurement layer. Expense reports and SaaS spend management tools surface subscriptions nobody told IT about. Ask vendors on your approved list whether they have shipped AI features and where inference runs.
People layer. Run an amnesty survey. Phrase it as "help us build the approved list", not "confess". In peer discussions the amnesty approach reliably surfaces more use cases than any log review, and it tells you which tools people actually value.
Should you ban ChatGPT and similar tools?
Blanket bans fail for a predictable reason: they push usage onto personal devices and personal accounts, where you have zero visibility and zero DLP. The practitioner consensus has settled on a different posture:
- Sanction a safe path. Provide at least one enterprise-grade assistant (ChatGPT Enterprise, Microsoft 365 Copilot, Gemini for Workspace, Claude for Enterprise or a private deployment) where prompts are not used for training and data stays under your tenant and your contracts.
- Tier your tools. Approved for all data; approved for internal data only; approved for public data only; blocked. Publish the tiers. Keep the list short and reviewed quarterly.
- Block what you cannot see into. Consumer tiers of the same products should be blocked at the proxy once the enterprise tier exists, otherwise users default to the frictionless option.
- Make the request path fast. If a team can get a new AI tool reviewed in two weeks, they will ask. If it takes a quarter, they will not.
What should a shadow AI policy include?
A policy nobody reads is a compliance artifact, not a control. Keep it to two pages and cover these elements:
- Scope and definitions. What counts as an AI tool (including features inside existing software and self-built agents).
- Data rules by classification. Map your existing data classification scheme to AI use: what can never be entered into any external model, what requires the sanctioned tier, what is unrestricted. If your classification scheme is not fit for this, that is the finding, and it belongs in your AI governance framework.
- Approved tools and the request process. Link to the live list and the intake form.
- Human accountability for outputs. The person who uses AI output is responsible for verifying it before it reaches a customer, regulator or decision.
- Agent and automation rules. Any AI that can act (send, write, execute, approve) needs its own identity, scoped permissions and an owner. This is where agentic AI security begins.
- Monitoring and consequences. State plainly that AI usage is logged and reviewed, and what happens when the policy is breached.
- Review cadence. Quarterly, because the tool landscape changes faster than annual policy cycles.
Align the policy with the frameworks your auditors will ask about: NIST AI RMF for the risk vocabulary, ISO/IEC 42001 if you intend to certify an AI management system, and your sector regulator's guidance.
How does DLP work for AI tools like Copilot and ChatGPT Enterprise?
Data loss prevention for AI has three enforcement points, and mature programs use all three.
At the prompt. Browser and endpoint DLP can inspect what is typed or pasted into AI web apps and block or warn based on classification labels and pattern matches. This is the only control that works for tools outside your tenant.
At the data source. Microsoft 365 Copilot, and any retrieval-augmented tool pointed at your own data, can only surface what the user already has permission to see. In practice that means years of over-shared SharePoint sites and open file shares become instantly searchable. Sensitivity labels, access reviews and a credible data security posture management capability are prerequisites, not nice-to-haves. Most Copilot rollouts that stall do so here.
At the API and agent layer. For self-built applications and agents, inspect inputs and outputs at the gateway: redact PII before it reaches the model, filter outputs for sensitive patterns, and log prompts and completions for review. Treat your model gateway as a control point with the same seriousness as your web application firewall.
A practical sequencing: start with prompt-level DLP on the sanctioned tools (fast, visible), run access reviews and labeling on the highest-value repositories before enabling retrieval features, and bring self-built applications under a gateway before they reach production.
Key takeaways
- Shadow AI is a data problem wearing a tooling costume. Govern the data flows, not just the apps.
- Discovery must be layered: proxy, identity, endpoint, developer, procurement and people. The identity layer is where agentic shadow AI hides.
- Bans push usage into the dark. Sanction a safe path, tier the rest, block consumer tiers of sanctioned tools.
- A two-page policy mapped to your data classification scheme beats a twenty-page one nobody reads.
- Retrieval-based tools such as Copilot expose over-sharing you already have. Fix access and labeling before you switch them on.
- Treat model gateways and agent permissions as first-class control points.
Join your peers at AI + Data Security World 2027
Six cities, one room where security, data and privacy leaders compare notes on exactly these problems: Melbourne, May 5 · San Francisco, July 15 · London, September 15 · Singapore, September 30 · Sydney, October 14 · New York, November 11.
Not ready to register? Sign up for updates and we will send agenda releases and practitioner insights as they publish.