The use of AI tools at work without the knowledge or approval of the organization, usually by people trying to get their work done.
Definition
Shadow AI is the use of AI tools for work that the organization has not approved or does not know about: a personal chatbot account used to summarize a contract, a browser extension that rewrites emails, or a free tool used to analyze a spreadsheet. It is the AI form of shadow IT. It appears because the tools are easy to reach and useful, and because approved options are slow, missing, or unknown. The main risks are that confidential or personal data leaves the organization, that outputs are used without review or record, and that the organization cannot assess or control what it cannot see.
History
The term comes from shadow IT, which describes unsanctioned software and cloud services used by employees. It spread to AI after the public release of generative AI chat tools in 2022 and 2023, when many organizations found that staff were already using them. Surveys of workers have repeatedly reported use of unapproved tools, though numbers vary by survey.
When to Use
Look for shadow AI whenever you write or revise an AI policy, before and after you roll out an approved tool, and when you review incidents. Treat it as a signal about unmet needs as well as a control problem.
Step-by-Step
- Ask first. Run an open, no-blame survey of which tools people use and for what.
- Read the answers as demand. Each use shows a task people want help with.
- Provide approved options that are fast to reach, with data terms that fit the data class.
- Publish a short data rule that says which class of data may go into which kind of tool.
- Use technical controls as a net, such as web filtering or data loss prevention, knowing they miss things.
- Make it easy to ask for a new tool and answer within days.
- Review the register and the findings regularly.
Examples
- A planner pastes a customer order list into a free chatbot to build a summary. The data is confidential; the approved tool was slow to reach.
- A browser extension that offers to rewrite text reads every page the user opens.
- A team subscribes to an AI note-taker for supplier calls without checking the contract terms.
Common Pitfalls
- A ban with no alternative: use moves out of sight.
- Blame: people stop telling you what they use.
- Relying on blocking alone: staff use personal devices.
- No answer to requests: slow approval drives people to workarounds.