Shadow AI happens when employees use AI tools or features without IT or security knowing about it. This could be someone pasting customer data into their personal ChatGPT, or a new AI feature quietly added to approved software. What matters is not the tool itself, but that no one is watching or approving its use.
On May 5, 2026, a Pennsylvania bank found out that an employee was using an unauthorized AI app to handle customer names, Social Security numbers, and birth dates (Wilson Sonsini). There was no hacker, outage, or ransom demand. Six days later, the bank’s parent company filed the first SEC Form 8-K caused by shadow AI. The sensitive data involved made the incident significant.
Key takeaways
- Shadow AI is unapproved, unmonitored AI use: the same tool can be sanctioned in one configuration and shadow in another. The boundary test is four questions: approval, account, visibility, data class.
- Unlike shadow IT, shadow AI moves data in prompts and pastes that cannot be revoked or retrieved, and every prompt containing personal data is regulated processing.
- About two in three breached organizations lack a finished AI governance policy, and fewer than a third of organizations with policies audit for unsanctioned AI.
- Blocking backfires; tiered governance with fast approvals and a living inventory works.
- Govern connections, not just tools: agents and MCP connectors turn one-time pastes into standing data flows.
If you are a DPO, privacy counsel, or GRC lead responsible for these issues, this page explains shadow AI, its risks, and how to spot it.
What is shadow AI?
Shadow AI means any unreviewed AI systems used for work, not just unapproved software as in traditional shadow IT, no matter how popular the tool is.
The term covers three situations:
- Unapproved tools: a personal ChatGPT, Claude, or Gemini account used for work.
- Unapproved usage of approved tools: a sanctioned platform processing data it was never cleared to handle.
- Invisible AI inside approved software: a CRM or support desk that ships a new AI feature which processes your data before anyone reviews the change.
The third situation is what makes shadow AI different from older procurement issues. The main tool was approved, but the new feature was not, and it may have appeared through a regular product update instead of a new purchase. No one in your organization actually chose to add it.
The artificial intelligence tools themselves are not the problem. The products named here are legitimate tools that deliver real productivity gains and can boost productivity, which is why employees adopt them in the first place. The exposure comes from the shadow part: usage that is unreviewed, unmonitored, and unaccounted for. The answer is governance that makes safe use easy, not suspicion of the technology.
How is shadow AI different from shadow IT?
Shadow IT is unapproved technology; shadow AI is unapproved technology that ingests your data, and unapproved AI models can produce outputs your organization may rely on. The differences compound:
| Dimension | Shadow IT | Shadow AI |
|---|---|---|
| What changes hands | Access, credentials, stored files | Data leaves in prompts and uploads, often including personal data |
| Purchase trail | Usually a card or invoice exists | Frequently none: free tiers and features inside existing contracts |
| Reversibility | Deprovision the account, revoke access | Pasted data cannot be unlearned by a model or reliably retrieved |
| Who introduces it | Teams making tooling decisions | Anyone with a browser, in an afternoon |
| Output risk | Misconfiguration, sprawl | The organization acts on unverified, unaccountable AI output |
| Discovery | Asset inventory, expense audits | Inventory plus content-level visibility most tools lack |
The usual shadow IT playbook (find the contract, revoke the license) closes only part of the problem. Shadow AI often involves one-time actions, like pasting data, not ongoing subscriptions, and these tools operate outside normal approval and visibility controls. There is nothing to revoke.
How does shadow AI get in?
Shadow AI gets in through processes, not formal decisions, and most do not need anyone to approve a purchase; employees often turn to new tools on their own when sanctioned options are slower:
- Instant access: consumer AI tools need a browser and an email address. There is no install to block and no invoice to audit.
- Approval friction: when the sanctioned path takes weeks, but the unsanctioned one takes thirty seconds, employees bypass the process and hide the workaround.
- AI features inside approved software: SaaS vendors ship AI assistants as product updates; the tool was vetted last year, the feature was not.
- Browser extensions and plug-ins: AI plug-ins and browser plug-ins are a common path in shadow AI because summarizers, writing assistants, and notetakers can see whatever is on screen.
- Coding assistants and agents: repository access and command execution granted in a few clicks.
- Open-source and hosted models: external AI and generative AI models can be accessed through web interfaces or API calls without review.
The four boundary questions (approval, account, visibility, and data class) apply here too, one level down. When an approved vendor adds a new AI feature, check again to make sure the new data flow is approved, visible, and fits your allowed data classes.
How common is shadow AI, and what does it cost?
Adoption and behavior, from primary sources:
- 78% of organizations reported AI use in 2024, up from 55% in 2023. (Stanford HAI, AI Index Report 2025)
- 74% to 96% was the increase in organizations with generative AI application traffic from 2023 to 2024. (Netskope Threat Labs, Cloud and Threat Report: AI Apps in the Enterprise)
- 45% of enterprise users were actively using AI platforms, based on browser telemetry from LayerX’s customer base. (LayerX, Enterprise AI and SaaS Data Security Report 2025)
- 77% of employees pasted data into generative AI prompts. Of that activity, 82% came from unmanaged personal accounts and 22% contained personal or payment card data. (LayerX, Enterprise AI and SaaS Data Security Report 2025)
- 43% of workers admitted to sharing sensitive work information with AI tools without their employer’s knowledge. The survey included approximately 7,000 respondents across 7 countries. (CybSafe / National Cybersecurity Alliance, Oh, Behave! 2025–2026)
Breach impact and governance gaps, from IBM’s 2026 Cost of a Data Breach Report (IBM Newsroom, Ponemon Institute, 602 breached organizations):
- 43% of security incidents involved shadow AI, more than double the share reported in 2025.
- $5.39 million was the average cost of a breach involving shadow AI, up from $4.63 million in 2025.
- 92% of organizations that experienced an AI-related breach lacked adequate AI access controls.
- 68% of breached organizations either had no AI governance policy or had one still in development. This included 35% with no policy at all and 33% with a policy still being developed.
- 29% of organizations with AI governance policies conducted regular audits for unsanctioned AI use.
One poll of 250 UK CISOs found one in five admitting an employee exposed sensitive company data through AI tools, with staff also unknowingly exposing sensitive information when using external AI tools. 75% rated insider threats as a greater risk than external ones (RiverSafe survey). The pattern is consistent: AI usage is near-universal, governance is rare, and widespread AI usage plus rapid AI adoption are now outpacing governance.
What does shadow AI look like in practice?
Most shadow AI is ordinary work done through an ungoverned channel, and unauthorized AI tools often show up because they seem like the quickest fix for getting work done:
| Role | Typical scenario | Data at risk |
|---|---|---|
| Sales | Pastes call notes and contact lists into a personal AI account to draft follow-ups | Customer PII, deal terms |
| HR | Screens resumes through an unapproved AI tool | Candidate PII, potentially sensitive categories |
| Finance | Uploads a forecast spreadsheet to get formula help | Non-public financials |
| Engineering | Connects a coding assistant with repository access | Source code, credentials embedded in code |
| Marketing | Uses shadow AI tools in campaign or content workflows to summarize support tickets and web pages, creating the same privacy and compliance exposure | Whatever is on screen, including customer records |
| Anyone | An AI notetaker joins meetings without a review | Everything said in the room |
None of these require bad intent. They require a deadline, a browser, and the absence of a governed alternative.
Where does the data go?
A prompt typed into an AI tool starts a data journey most policies describe in one sentence, and most organizations have never traced:
- The browser: data leaves your environment the moment it is typed, pasted, or captured by an extension, and employees may send sensitive information to external tools before anyone notices. This is the last point where your controls can directly observe the flow.
- The vendor endpoint: the data now sits with a specific legal entity under specific terms, and whether those are the consumer product’s or an enterprise agreement’s determines nearly everything that follows.
- Retention: consumer tiers commonly retain conversation histories; retention and deletion rights vary sharply by tier and by whether anyone negotiated them.
- Training use: depending on the tier and settings, inputs may be used to improve the provider’s models. Once personal data enters a training pipeline, retrieval and erasure become requests, not controls.
- Subprocessors: the AI vendor’s own cloud and model infrastructure is a further set of recipients your vendor review never covered, often sitting in cloud environments the organization has never reviewed for AI security.
External AI use is still ordinary third-party processing, with the same security risks and compliance duties as any other outbound data flow.
Data privacy regulators treat this journey as ordinary data processing, not a novelty. The European Data Protection Board’s ChatGPT task force concluded that prompts containing personal data fall under the GDPR and providers cannot shift responsibility for that processing onto users through their terms. It also held that individuals must be informed under Article 13 when their prompt data will be used for training (EDPB, Report of the ChatGPT Taskforce, 23 May 2024). What your staff types into a chat window is regulated processing. Not knowing changes nothing.
For how this channel compares to the classic leakage paths, see our guide to data leakage. To learn what can and cannot be observed at the browser layer, read the web tracking guide.
What are the risks of shadow AI?
The growing use of AI tools and AI services expands the organization’s attack surface when adopted outside governance. Risks ordered by personal-data exposure, because that is where accountability lands first:
| Risk | What happens | Regulatory hook |
|---|---|---|
| Personal data in prompts | Customer or employee data becomes processed by an unvetted controller, on retention and training terms nobody reviewed | GDPR (fines up to €20M or 4% of worldwide annual turnover, Art. 83(5)); GLBA for financial customer data |
| Health information | PHI entered into a tool with no business associate agreement | HIPAA |
| Payment data | Cardholder data pasted for analysis or formatting | PCI DSS obligations |
| Source code and IP | Trade secrets enter systems you cannot retrieve them from | Confidentiality, trade-secret protection |
| Output reliance | Staff act on confident, unverified AI output in customer-facing or regulated decisions; unmonitored AI outputs can introduce bias, inaccuracies, or hallucinations in results, and these ai risks can cause significant reputational damage when organizations act on bad outputs | FTC Act: deception and unfairness standards apply to AI claims and AI-assisted conduct |
| Record-keeping gaps | Processing happened that no record of processing, DPIA, or inventory reflects | Accountability duties across GDPR, CCPA, and sector regimes |
The enforcement posture behind these hooks is settled. Announcing the FTC’s first sweep of AI-related enforcement, Chair Lina Khan stated:
“There is no AI exemption from the laws on the books.”
The exposure does not wait for AI-specific legislation. It runs through the privacy, financial, and consumer-protection laws that already apply to the data, and the use of AI without review creates both compliance exposure and broader risks beyond pure data leakage.
How do you find shadow AI when your security stack misses it?
Shadow AI survives because the tools watching for it target a different problem, and security teams often miss it because their stack was built for a different visibility problem. Three structural blind spots explain most of the gap:
- Content blindness: network monitoring sees a connection to an AI domain, not the customer list pasted into the text box inside an encrypted session.
- Domain camouflage: an AI feature inside an approved SaaS product sends traffic to a domain your tools already trust.
- Channel shift: personal accounts, devices, and mobile apps bypass SSO, proxies, and endpoint agents by construction.
Each visibility layer sees a different slice and misses the rest:
| Visibility layer | What it sees | What it misses |
|---|---|---|
| Network / gateway / DNS | AI domains contacted, network traffic volumes | Contact with AI domains, but not what was entered into the session |
| CASB / SaaS posture | OAuth grants, configurations of sanctioned apps | Personal accounts, consumer tiers, feature-level AI additions |
| Endpoint and browser | Extensions, installed assistants, page-level scripts and flows | Server-side processing after the data leaves |
| Identity and secrets scanning | API keys in repositories, service accounts, non-human identities | Human pastes through web UIs |
| People | Intent, context, and the tools colleagues actually use | Whatever stays hidden for fear of blame |
Effective management of shadow AI requires balancing visibility with the need for innovation so employees will disclose real AI usage.
First moves you can make this week, in order of effort:
- Ask before you scan: conduct an anonymous, amnesty-backed survey of which AI tools people use and for what. It is the fastest inventory and the only one that captures intent.
- Inventory OAuth grants: every “Sign in with Google/Microsoft” grant to an AI service is a documented connection you can enumerate today.
- Inventory browser extensions: broad page-read permissions are shadow AI infrastructure whether or not the extension calls itself AI.
- Pull the money trail: expense reports and card statements for AI subscriptions.
- Re-review approved SaaS: list which vendors shipped AI features since your original assessment, then review unapproved AI platforms and AI features introduced into approved SaaS.
These moves find the visible majority. Read the Complete shadow AI detection playbook.
Is ChatGPT at work shadow AI?
Sometimes. The tool matters less than the conditions of use, and four questions draw the line:
- Approval: has IT or security reviewed and approved this tool for work use?
- Account: is it running under a corporate account with data-handling terms, or a personal or free-tier account?
- Visibility: can the organization see what data goes into it?
- Data class: does the information being entered stay within the categories your policy allows?
If any answer is no or “we don’t know,” that usage is shadow AI. The same product can be sanctioned in one configuration and shadow in another. Microsoft 365 Copilot under an enterprise agreement with reviewed data terms is sanctioned; the same employee’s personal ChatGPT account drafting the same document is shadow. A free-tier account that the security team cannot see or configure fails questions two and three and lacks proper security oversight. Informal tolerance is not approval.
Should you just block AI tools?
No, and organizations that tried have the receipts. In May 2023, engineers at Samsung pasted source code and a meeting transcript into ChatGPT three times in about twenty days. The company responded by restricting generative-AI use on its devices and networks, with disciplinary action up to termination (Bloomberg). The restriction treated the symptom. The demand behind it didn’t go away.
Blocking fails for two structural reasons. First, it pushes usage to personal devices and accounts where your visibility drops to zero. Second, it destroys the signal. Shadow AI is evidence of unmet needs, a map of where your tooling and approvals are too slow. Amnesty-based disclosure surfaces what surveillance cannot because most shadow AI users are trying to do their jobs, not harm the organization.
Olivia Rose, a CISO who has handled AI incidents first-hand, frames the response discipline:
“The first instinct is to react. And that’s never a good thing in cybersecurity… You need to think through your answer holistically and look at the level of risk to the organization before you respond.”
Govern the demand, don’t criminalize it. Provide approved, usable AI options and clear guardrails so employees do not need to turn to hidden tools.
How do you govern shadow AI?
Governance means deciding, per tool and per data class, what is allowed, then making the decision visible and owned. The working model is four tiers:
| Tier | Data rules | Accountable owner |
|---|---|---|
| Approved | Cleared for defined data classes, including specified personal data under reviewed terms | Named business owner + security/privacy sign-off |
| Monitored | Allowed for low-sensitivity work, usage observed, no regulated data | IT/security monitors, with the business owner accountable |
| Restricted | Specific features or data classes prohibited, with technical or policy controls applied | Privacy/compliance sets the boundary |
| Blocked | No organizational data; access prevented where feasible | Security owns enforcement |
Three frameworks do most of the structural work. The NIST AI Risk Management Framework supplies the risk-management spine, and ISO/IEC 42001 defines an AI management system. The EU AI Act adds hard law: penalties applicable since 2 August 2025 reach €35 million or 7% of worldwide annual turnover for prohibited-practice infringements (Regulation (EU) 2024/1689, Art. 99). The high-risk obligations phase in through December 2027 and August 2028 under the Digital Omnibus amendments. For personal data, the GDPR and the EDPB’s prompt-processing position apply regardless.
Ownership is the unresolved question in most organizations. CISOs see a security problem, privacy officers see ungoverned processing, AI leads see an adoption program. The practical answer is a cross-functional owner per tier, with privacy holding the pen on data-class rules. Security teams, privacy, and business owners need shared oversight of AI usage, not separate approval tracks. The CISO can judge the tool. Only the privacy function can say what personal data may flow to it.
Approval speed is the control. A defined review with a defined turnaround gives employees a sanctioned path that can compete with the thirty-second unsanctioned one.
Organizations with mature AI programs often route external AI and generative AI tools through centralized AI gateways. Centralized AI gateway architecture gives organizations a controlled path for AI services while preserving visibility and policy enforcement.
Finally, keep the evidence an examiner will ask for: a living, risk-ranked inventory of the AI tools and features in use, the data classes each touches, and the tier each sits in. That inventory should cover approved and unauthorized use across AI systems, including external AI connections. “We have a policy” is a claim; the inventory is evidence.
Our third-party privacy risk guide explains the diligence questions and the limits of attestations.
Request AI vendor assessment →
What do AI agents and MCP servers change?
The next wave of shadow AI doesn’t wait for a human to paste anything. AI agents read, decide, and act. They send email, edit repositories, query databases, call APIs, write code, and move files. MCP (Model Context Protocol) servers and similar connectors let employees wire those agents directly into internal systems in a few clicks, often without review. Each connection is a standing data flow, not a one-time paste.
That raises the stakes. The boundary test now applies to connections, not just tools, and the inventory needs non-human entries. The risk model gets sharper here: an agent combines capabilities that are individually manageable and jointly dangerous, which creates AI security concerns because autonomous actions can magnify a small policy gap.
Security researcher Simon Willison calls the combination the “lethal trifecta”: access to private data, exposure to untrusted content, and the ability to communicate externally.
“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker”
An ungoverned agent with all three is not a productivity shortcut, it is an exfiltration channel with a friendly interface.
How does MELURNA help with Shadow AI?
Shadow AI is a visibility problem that frequently starts in the browser. Because popular generative AI tools like ChatGPT, Claude, and Gemini are free and readily available, employees can use them instantly without IT approval. MELURNA bridges this visibility gap. By monitoring the client-side layer, MELURNA maps the third-party scripts, extensions, and embedded tools connecting to AI endpoints from your properties. This browser-level vantage point lets you instantly audit actual data flows against your official AI policies.
FAQs
Is shadow AI illegal?
Not in itself. No law prohibits an employee from using an unapproved tool. What can be unlawful is processing that results in personal data, protected health information, or other sensitive data flowing to an unvetted recipient without a legal basis, a compliant contract, or the required disclosures. The risk sits in the data flow, not the tool choice.
What is shadow GPT?
An early term for the same phenomenon, coined when ChatGPT was essentially the only tool employees used without approval. As usage spread across hundreds of tools and embedded AI features, “shadow AI” became the general term.
Can our existing DLP detect shadow AI?
Partially. DLP catches defined patterns in channels it inspects, such as file uploads or email, but it wasn’t built for paste-into-textbox events inside encrypted browser sessions, AI features riding inside approved SaaS domains, or personal-account usage. Treat it as one visibility layer, not the answer.
What should an AI acceptable-use policy include?
At minimum: the four tiers and their data rules, the approval path and its turnaround commitment, the prohibited data classes, and the disclosure channel for tools already in use.
Is shadow AI the same as AI sprawl?
No. AI sprawl is the uncontrolled multiplication of approved AI tools and projects. Shadow AI is AI operating outside approval and visibility. Sprawl is a governance-efficiency problem; shadow AI is a governance-existence problem.
DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.