Shadow AI is the use of AI tools, features or services inside an organisation without the knowledge or approval of IT, security or management. It’s the AI version of shadow IT, and it’s spreading faster, because AI tools are free, browser-based and genuinely useful.
How shadow AI shows up
- Staff using personal chatbot accounts for work tasks.
- Browser extensions that read pages and summarise or rewrite text.
- AI meeting recorders and transcription bots joining calls.
- AI features switched on in existing SaaS, such as CRM, help desk or office tools, without review.
- Developers using AI coding assistants or calling AI APIs with personal keys.
- Teams building automations that send company data to AI services.
Why it happens
Mostly with good intentions. People want to work faster, the tools are easy to access, and the approved route is slow, unclear or doesn’t exist. Shadow AI is usually a sign that demand is ahead of governance.
The risks
- Data leakage: confidential, personal or client data pasted into tools with unknown retention and training terms. See AI chatbot data leakage.
- Compliance breaches: GDPR problems such as unknown processors and international transfers, client contract violations, and gaps in EU AI Act obligations you can’t manage for tools you don’t know about.
- Security exposure: malicious or vulnerable extensions, AI tools with broad account access, and leaked credentials.
- Quality and liability: unchecked AI output reaching customers or decisions.
- No audit trail: when something goes wrong, you can’t investigate it.
How to manage shadow AI
1. Find it
Ask teams with a short, no-blame survey. Combine that with data you already have: SSO and network logs, browser extension inventories, expense claims for AI subscriptions, and SaaS admin panels for AI features. Add what you find to your AI inventory.
2. Offer a good approved option
The most effective control is a sanctioned tool that’s as easy as the shadow one: a business-grade AI assistant with data protection terms, single sign-on and admin controls. Blanket bans without alternatives push usage further underground.
3. Set clear rules
An AI acceptable use policy that says which tools are approved, what data may never be used, and how to request new tools, with a fast approval path.
4. Add technical guardrails
- Block or warn on high-risk, unapproved AI services where justified.
- Control browser extensions on managed devices.
- Use data loss prevention to stop sensitive data being pasted into AI sites.
- Review OAuth app permissions that grant AI tools access to email, files or calendars.
5. Train people
Explain why: what happens to data in consumer AI tools, and which tools are safe. This also supports the EU AI Act‘s AI literacy duty.
6. Keep listening
Treat requests for new tools as useful signals about what people need, and review the approved list regularly.
The bottom line
You won’t eliminate shadow AI by banning it. You shrink it by making the approved path easier than the shadow one, and by being able to see what’s in use.
Official sources
- GDPR, Regulation (EU) 2016/679: the EU’s data protection law
- EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
- ICO guidance on AI and data protection: the UK regulator’s guidance under the UK GDPR
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. This article is general information, not legal advice.